From 25c69da42cd4a34f2ec2777f932ad91f753e79b2 Mon Sep 17 00:00:00 2001 From: Simon McVittie Date: Tue, 26 Feb 2019 21:06:45 +0000 Subject: Prepare 3.20190228 for future release --- CHANGELOG | 34 +++++++++++++++++++++++++++++++--- 1 file changed, 31 insertions(+), 3 deletions(-) (limited to 'CHANGELOG') diff --git a/CHANGELOG b/CHANGELOG index 5237ee7b8..f32a43ff4 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,5 +1,33 @@ -ikiwiki (3.20190208) UNRELEASED; urgency=medium - +ikiwiki (3.20190228) upstream; urgency=medium + + * aggregate: Use LWPx::ParanoidAgent if available. + Previously blogspam, openid and pinger used this module if available, + but aggregate did not. This prevents server-side request forgery or + local file disclosure, and mitigates denial of service when slow + "tarpit" URLs are accessed. + (CVE-2019-9187) + * blogspam, openid, pinger: Use a HTTP proxy if configured, even if + LWPx::ParanoidAgent is installed. + Previously, only aggregate would obey proxy configuration. If a proxy + is used, the proxy (not ikiwiki) is responsible for preventing attacks + like CVE-2019-9187. + * aggregate, blogspam, openid, pinger: Do not access non-http, non-https + URLs. + Previously, these plugins would have allowed non-HTTP-based requests if + LWPx::ParanoidAgent was not installed. Preventing file URIs avoids local + file disclosure, and preventing other rarely-used URI schemes like + gopher mitigates request forgery attacks. + * aggregate, openid, pinger: Document LWPx::ParanoidAgent as strongly + recommended. + These plugins can request attacker-controlled URLs in some site + configurations. + * blogspam: Document LWPx::ParanoidAgent as desirable. + This plugin doesn't request attacker-controlled URLs, so it's + non-critical here. + * blogspam, openid, pinger: Consistently use cookiejar if configured. + Previously, these plugins would only obey this configuration if + LWPx::ParanoidAgent was not installed, but this appears to have been + unintended. * po: Always filter .po files. The po plugin in previous ikiwiki releases made the second and subsequent filter call per (page, destpage) pair into a no-op, @@ -11,7 +39,7 @@ ikiwiki (3.20190208) UNRELEASED; urgency=medium that prevented repeated filtering. Thanks, intrigeri (Closes: #911356) - -- Simon McVittie Sun, 24 Feb 2019 17:11:39 +0000 + -- Simon McVittie Tue, 26 Feb 2019 21:05:49 +0000 ikiwiki (3.20190207) upstream; urgency=medium -- cgit v1.2.3