CVE-2021-30159

Name	CVE-2021-30159
Description	An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certain "fast double move" situations. MovePage::isValidMoveTarget() uses FOR UPDATE, but it's only called if Title::getArticleID() returns non-zero with no special flags. Next, MovePage::moveToInternal() will delete the page if getArticleID(READ_LATEST) is non-zero. Therefore, if the page is missing in the replica DB, isValidMove() will return true, and then moveToInternal() will unconditionally delete the page if it can be found in the master.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2648-1, DSA-4889-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mediawiki (PTS)	stretch (security)	1:1.27.7-1+deb9u11	fixed
	stretch (lts), stretch	1:1.27.7-1+deb9u13	fixed
	buster (security), buster, buster (lts)	1:1.31.16-1+deb10u8	fixed
	bullseye	1:1.35.13-1+deb11u2	fixed
	bullseye (security)	1:1.35.13-1+deb11u3	fixed
	bookworm (security), bookworm	1:1.39.10-1~deb12u1	fixed
	sid, trixie	1:1.39.10-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
mediawiki	source	stretch	1:1.27.7-1~deb9u8	DLA-2648-1
mediawiki	source	buster	1:1.31.14-1~deb10u1	DSA-4889-1
mediawiki	source	(unstable)	1:1.35.2-1

https://phabricator.wikimedia.org/T272386
https://lists.wikimedia.org/pipermail/wikitech-l/2021-April/094418.html