-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Tue, 26 Feb 2019 23:04:42 +0000 Source: ikiwiki Architecture: source Version: 3.20190228-1 Distribution: unstable Urgency: high Maintainer: Simon McVittie <smcv@debian.org> Changed-By: Simon McVittie <smcv@debian.org> Closes: 911356 Changes: ikiwiki (3.20190228-1) unstable; urgency=high . * New upstream release - aggregate: Use LWPx::ParanoidAgent if available. Previously blogspam, openid and pinger used this module if available, but aggregate did not. This prevents server-side request forgery or local file disclosure, and mitigates denial of service when slow "tarpit" URLs are accessed. (CVE-2019-9187) - blogspam, openid, pinger: Use a HTTP proxy if configured, even if LWPx::ParanoidAgent is installed. Previously, only aggregate would obey proxy configuration. If a proxy is used, the proxy (not ikiwiki) is responsible for preventing attacks like CVE-2019-9187. - aggregate, blogspam, openid, pinger: Do not access non-http, non-https URLs. Previously, these plugins would have allowed non-HTTP-based requests if LWPx::ParanoidAgent was not installed. Preventing file URIs avoids local file disclosure, and preventing other rarely-used URI schemes like gopher mitigates request forgery attacks. - aggregate, openid, pinger: Document LWPx::ParanoidAgent as strongly recommended. These plugins can request attacker-controlled URLs in some site configurations. - blogspam: Document LWPx::ParanoidAgent as desirable. This plugin doesn't request attacker-controlled URLs, so it's non-critical here. - blogspam, openid, pinger: Consistently use cookiejar if configured. Previously, these plugins would only obey this configuration if LWPx::ParanoidAgent was not installed, but this appears to have been unintended. - po: Always filter .po files. The po plugin in previous ikiwiki releases made the second and subsequent filter call per (page, destpage) pair into a no-op, apparently in an attempt to prevent *recursive* filtering (which as far as we can tell can't happen anyway), with the undesired effect of interpreting the raw .po file as page content (e.g. Markdown) if it was inlined into the same page twice, which is apparently something that tails.org does. Simplify this by deleting the code that prevented repeated filtering. Thanks, intrigeri (Closes: #911356) Checksums-Sha1: 23fbaf51ff241ee4a4217acad7ec314487d5cfc3 2522 ikiwiki_3.20190228-1.dsc 46f5b0a1498c1e098fe248eae1f2e3f56b25dc2f 2672244 ikiwiki_3.20190228.orig.tar.xz 3117a095beda469da00db825ea5d3862f507dbb9 86996 ikiwiki_3.20190228-1.debian.tar.xz 4d0bde5b1ba48cd44057fae507dde5aee250e52c 4969 ikiwiki_3.20190228-1_source.buildinfo Checksums-Sha256: 963d9cc94926faddd17e21c10cc20b72e2d49280a7e61cf2986f8e20f6f6da60 2522 ikiwiki_3.20190228-1.dsc d07a4d0da60c3e4de698a4dc54d0445547e762b37f0d433b0d664d88155dfe9e 2672244 ikiwiki_3.20190228.orig.tar.xz 0bc38826600d23b572fe03704b8f10cd13ec111cf6bcd94bf0d9d09f83d2e42d 86996 ikiwiki_3.20190228-1.debian.tar.xz 10cb6aaf5ea89b43aac162abddc9b95e98c577ccb4e21d84321f8593b5f68c2d 4969 ikiwiki_3.20190228-1_source.buildinfo Files: 985468a47fdec9139ad07389d6b588d9 2522 web optional ikiwiki_3.20190228-1.dsc 7d3b0b1fd375fc94b30b3397b260e61f 2672244 web optional ikiwiki_3.20190228.orig.tar.xz fb48c5068071da26b100da3b878b32c4 86996 web optional ikiwiki_3.20190228-1.debian.tar.xz 3d736ea01b161e377cdad06461d87ad8 4969 web optional ikiwiki_3.20190228-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEENuxaZEik9e95vv6Y4FrhR4+BTE8FAlx4Ig4ACgkQ4FrhR4+B TE+YlBAAk/soeKca813hRM1csFMfb10nuy02w2rYLd9mU8iifN3qV0MpIp5xO+uU N+kIaA3+9L70NyZA6Aovh+0V4ktjdIiyTw0l4/Ir+LDjeT0apq6Y6AMpw76x4wx+ 7Yuifys3nmfHb0QzV5v/owjFFBHZYzOS9uJ/S9LNqF2j1rJXEzUhdonNK+A5sYp+ ih/94SpwV5eljMQQ5aII8dUGP/5KBopeCv4tuFPfMC2o7XxeVh/9/1gws74Krqpo CeMWktcw82AT66IZkUcfEfiaxmcCYZeZKt+n9YQoCH7cySOQ8f+x/tz+Q1xciBHy aH/yinIEBOYlUmOSNj8y1LqX1UPZBdZylsMiIrCItOeaEulxxKQLTsyjzTKSYMpr hvo3FlXIK+dcP/dl4NB3tYjq+Veb/OxUQ6bcqy7ELXfjtyoSnUetOOO3L9+dIkYq KJ7pBgRWdm5qTCUWkqu9Wdj/G7LKbFbwi/mnivD7zPGm9S0Joq6UhW83UZu2qSyp UiWCU1W1UjG3uQnbQ+mZZfBM5O5BWDYvWStGVGyniTeDfIqfMHlnCby/vi2V/wFB 3S0fcui720SkPtyFTXCXp8KBWYAeUJQsjlZEYQuxUDDsQO3znl5yvV5LOyoOjoNq cPKsUdrwGyrpszO3QfrcCVdrEHmb9dSz+CpRh3IJR7zxzfOwrVo= =eBiv -----END PGP SIGNATURE-----
