The First Security- & Bugfix Release of the latest WordPress branch is now available. WordPress do not mention the vulnerabilities fixed on the download page, but BlogSec recommended 2.5 users upgrade ASAP.
Of all the bugs fixed, two fairly critical security issues were fixed. A Cross-Site Scripting vulnerability and the WP 2.5 Cookie Integrity Protection Vulnerability, discovered by Steven J. Murdoch.
The latest WordPress 2.5.1 can be downloaded from WordPress.
WordPress discuss the vulnerabilities here and as part of their development feed.
Comments
Phil, should we add this to our When to Upgrade article? ;)
In my humble opinion the approach to use filtering and sanitation on demand will never work for fast growing web applications.
What WordPress needs the opposite approach - filter everything and exclude the values you are sure to be unable to cause trouble.
More detailed writeup of the cookie integrity vulnerability here, for anyone interested: http://www.veracode.com/blog/?p=90
Do you advice upgrading from 2.3.3 to 2.5.1 ? is 2.5.1 fully secure like 2.3.3..
I will probably wait for 2.5.2/3 before I upgrade. It really depends on the next round of fixes.
-
Search site:
-
Additional WP Resources
