From 2bf2af30eaf62833bd07005cec103374fc0a7cae Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Fri, 30 May 2008 18:26:04 -0400 Subject: [PATCH] more on the security hole --- doc/news/version_2.48.mdwn | 4 +++- doc/security.mdwn | 10 ++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/doc/news/version_2.48.mdwn b/doc/news/version_2.48.mdwn index c5e0e830d..d78b42c54 100644 --- a/doc/news/version_2.48.mdwn +++ b/doc/news/version_2.48.mdwn @@ -1,3 +1,5 @@ +**This release fixes an important security hole, upgrade immediately.** + News for ikiwiki 2.48: If you allowed password based logins to your wiki, those passwords were @@ -21,4 +23,4 @@ ikiwiki 2.48 released with [[toggle text="these changes"]] * The password\_cost config setting is provided as a "more security" knob. * teximg: Fix logurl. * teximg: If the log isn't written, avoid ugly error messages. - * Updated French translation. Closes: #[478530](http://bugs.debian.org/478530)"""]] \ No newline at end of file + * Updated French translation. Closes: #[478530](http://bugs.debian.org/478530)"""]] diff --git a/doc/security.mdwn b/doc/security.mdwn index b3af3db3e..ea8954f5c 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -397,3 +397,13 @@ with strong blowfish hashes. You might also consider changing to [[plugins/openid]], which does not require ikiwiki deal with passwords at all, and does not involve users sending passwords in cleartext over the net to log in, either. + +## Empty password security hole + +This hole allowed ikiwiki to accept logins using empty passwords, to openid +accounts that didn't use a password. It was introduced in version 1.34, and +fixed in version 2.48. The [bug](http://bugs.debian.org/483770) was +discovered on 30 May 2008 and fixed the same day. + +I recommend upgrading to 2.48 immediatly if your wiki allows both password +and openid logins. -- 2.44.0