Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT Security Bulletin ASB-2019.0352.2 WordPress 5.3.1 Security and Maintenance Release 2 January 2020 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: wordpress Operating System: UNIX variants (UNIX, Linux, OSX) Windows Impact/Access: Cross-site Scripting -- Remote with User Interaction Unauthorised Access -- Remote/Unauthenticated Resolution: Patch/Upgrade Member content until: Wednesday, January 15 2020 Comment: This advisory references vulnerabilities in products which run on platforms other than UNIX variants (UNIX, Linux, OSX) or Windows. It is recommended that administrators running wordpress check for an updated version of the software for their operating system. Revision History: January 2 2020: Aligned XSS impact to require user interaction December 16 2019: Initial Release OVERVIEW A number of vulnerabilities have been identified in WordPress prior to version 5.3.1. [1] IMPACT The vendor has provided the following details regarding these issues: "Four security issues affect WordPress versions 5.3 and earlier; version 5.3.1 fixes them, so you'll want to upgrade. If you haven't yet updated to 5.3, there are also updated versions of 5.0 and earlier that fix the security issues. o Props to Daniel Bachhuber for finding an issue where an unprivileged user could make a post sticky via the REST API. o Props to Simon Scannell of RIPS Technologies for finding and disclosing an issue where cross-site scripting (XSS) could be stored in well-crafted links. o Props to the WordPress.org Security Team for hardening wp_kses_bad_protocol () to ensure that it is aware of the named colon attribute. o Props to Nguyen The Duc for discovering a stored XSS vulnerability using block editor content." [1] MITIGATION The vendor recommends updating to version 5.3.1 of WordPress to correct these issues. [1] REFERENCES [1] WordPress 5.3.1 Security and Maintenance Release https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/ AusCERT has made every effort to ensure that the information contained in this document is accurate. However, the decision to use the information described is the responsibility of each user or organisation. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXg1/1maOgq3Tt24GAQjKYRAAirZfZk5imVchXwZvEr00cMSk4TU9Q9K1 t7bn/jH4c9Ur0jVHPgG7+eALvAhJEeKj/k9QXw30eNoBnAsh7FRVWlFghh66AtYm VSe22VCKKftFj68Q2wS2KSsGGjJ/48YRuv0w3nTi86HwW2vUeIB94571lXaOUALi mtUOWhwkdLobChDrty//01DWF7Uuhr5VAua1yqgeSTvTHeRK1VPrblWGCZ+cwLlT QVuAQYXc1Y22j735mJ0yVND2Sfax3AH53n+KyXNqbBjJeF3YkUU2NWuHgq3uAZcI mDOk4xXBfoCoaF96SmAWCvuGMgZVm23GzeXAFqMWYtx3gMp5M1isX4RCPLg75SnA iOs8WlKY6GbOQWRQ5XZpygvSlUoQ8YppEjTvUhN53e5CBmpeazA82s5pzmeFcTwU NqElFRQUtN7gkpn2KCjt2EVi3riqFKTNZOyvaWo7g5DGkK1dNN/A9MPRdlfQPZag lcfTEBlZJQaqKy5tuhWIhQdcerARKVGKuch7zRGoQZ4pHBleW3VS1xlC9t3OQSE+ XUFk5BpAQDgOlgay7V9jdjcxTvtE4ODjuEnMyAjBWpFHevivdv5xcqkuHFDpS4SO deZYzi4rI100q7MGvgj2h2QHaRHdGyqSlvKfNeWQMJynyddSFSj7ePhw9ljRbP+W OpXcm9ac96E= =lGuG -----END PGP SIGNATURE-----