CVE-2017-0372 - log back

CVE-2017-0372 created at 25 Sep 2019 19:31:40
Severity
+ Medium
Remote
+ Remote
Type
+ Cross-site scripting
Description
+ The SyntaxHighlight extension in MediaWiki before 1.28.1 does not properly validate the 'start' parameter before passing it to Pygments.
References
+ https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html
+ https://phabricator.wikimedia.org/T158689
Notes
+ Apparently the fix is _not_, I repeat _not_, included in the 1.28.1 tarball: https://phabricator.wikimedia.org/T158689