Detections
Analytics

Fedora 31 : wordpress (2019-e16ba9e54e)

high Nessus Plugin ID 132661

Language:

Synopsis

The remote Fedora host is missing a security update.

Description

**WordPress 5.3.2 Maintenance Release**

Shortly after WordPress 5.3.1 was released, a couple of high severity Trac tickets were opened. The Core team scheduled this quick maintenance release to resolve these issues.

Main issues addressed in 5.3.2 :

 - Date/Time: Ensure that get_feed_build_date() correctly handles a modified post object with invalid date.

 - Uploads: Fix file name collision in wp_unique_filename() when uploading a file with upper case extension on non case-sensitive file systems.

 - Media: Fix PHP warnings in wp_unique_filename() when the destination directory is unreadable.

 - Administration: Fix the colors in all color schemes for buttons with the .active class.

 - Posts, Post Types: In wp_insert_post(), when checking the post date to set future or publish status, use a proper delta comparison.

----

See: [WordPress 5.3.1 Security and Maintenance Release](https://wordpress.org/news/2019/12/wordpress-5-3-1-security-a nd-maintenance-release/)

**Four security issues** affect WordPress versions 5.3 and earlier;
version 5.3.1 fixes them, so you’ll want to upgrade. If you haven’t yet updated to 5.3, there are also updated versions of 5.2 and earlier that fix the security issues.

 - Props to Daniel Bachhuber for finding an issue where an unprivileged user could make a post sticky via the REST API.

 - Props to Simon Scannell of RIPS Technologies for finding and disclosing an issue where cross-site scripting (XSS) could be stored in well-crafted links.

 - Props to the WordPress.org Security Team for hardening wp_kses_bad_protocol() to ensure that it is aware of the named colon attribute.

 - Props to Nguyen The Duc for discovering a stored XSS vulnerability using block editor content.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected wordpress package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2019-e16ba9e54e

Plugin Details

Severity: High

ID: 132661

File Name: fedora_2019-e16ba9e54e.nasl

Version: 1.1

Type: local

Agent: unix

Published: 1/6/2020

Updated: 1/6/2020

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:wordpress, cpe:/o:fedoraproject:fedora:31

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 1/5/2020

Vulnerability Publication Date: 1/5/2020

Reference Information