Bug 25725 - phpmyadmin new security issue CVE-2019-18622
Summary: phpmyadmin new security issue CVE-2019-18622
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: QA Team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2019-11-22 18:14 CET by David Walser
Modified: 2019-12-14 18:52 CET (History)
4 users (show)

See Also:
Source RPM: phpmyadmin-4.9.1-1.mga8.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2019-11-22 18:14:25 CET 
Upstream has issued an advisory on October 28:
https://www.phpmyadmin.net/security/PMASA-2019-5/

The issue is fixed upstream in 4.9.2:
https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released/

Mageia 7 is also affected.
David Walser 2019-11-22 18:14:34 CET

Whiteboard: (none) => MGA7TOO

Comment 1 Lewis Smith 2019-11-22 18:21:55 CET 
Assigning to the registered maintainer.

Assignee: bugsquad => mageia

Marc Krämer 2019-11-22 21:23:47 CET

Severity: major => normal

David Walser 2019-11-22 23:06:27 CET

Severity: normal => major

Comment 2 David Walser 2019-11-23 04:16:54 CET 
Marc uploaded phpmyadmin-4.9.2-1.mga8 for Cauldron.

Whiteboard: MGA7TOO => (none)
Version: Cauldron => 7

Comment 3 Marc Krämer 2019-11-23 12:39:17 CET 
@David: this is not very severe. This issue is kind of hypothetic.
But I'll push a new version to mga7 after testing cauldron.
Comment 4 David Walser 2019-11-23 16:24:21 CET 
It wasn't real clear that upstream calling it "serious" meant low severity, but it looks like you're right.

Severity: major => normal

Comment 5 Marc Krämer 2019-11-25 10:21:29 CET 
Updated phpmyadmin packages fix security vulnerabilitiy:

SQL injection in Designer feature.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-CVE-2019-18622


Updated packages in core/updates_testing:
========================
phpmyadmin-4.9.2-1.mga7.noarch.rpm

SRPM:
phpmyadmin-4.9.2-1.mga7.src.rpm

QA Contact: security => qa-bugs

Comment 6 David Walser 2019-11-26 23:36:45 CET 
This update also fixes CVE-2019-12922:
https://lists.opensuse.org/opensuse-updates/2019-09/msg00162.html
Comment 7 David Walser 2019-12-03 22:43:24 CET 
openSUSE advisory for CVE-2019-18622:
https://lists.opensuse.org/opensuse-updates/2019-12/msg00003.html
Comment 8 Marc Krämer 2019-12-04 00:34:53 CET 
missed to assign it to qa.
Advidory in comment #5

Assignee: mageia => qa-bugs

Comment 9 PC LX 2019-12-04 11:00:12 CET 
Installed and tested without issues.

Tested by normal usage and extra testing on a local host and a remote host, using a ssh tunnel. No issues or regressions.



System: Mageia 7, x86_64, Apache, MariaDB, Firefox, Chromium, Intel CPU.



$ uname -a
Linux marte 5.3.13-desktop-2.mga7 #1 SMP Mon Nov 25 20:30:40 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
$ rpm -q phpmyadmin apache mariadb
phpmyadmin-4.9.2-1.mga7
apache-2.4.39-1.mga7
mariadb-10.3.20-1.mga7

Whiteboard: (none) => MGA7-64-OK
CC: (none) => mageia

Comment 10 Thomas Andrews 2019-12-04 22:39:56 CET 
Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Thomas Backlund 2019-12-06 14:06:32 CET

Keywords: (none) => advisory
CC: (none) => tmb

Comment 11 Mageia Robot 2019-12-06 15:17:13 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0357.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 12 David Walser 2019-12-14 18:52:21 CET 
This update also fixes CVE-2019-19617:
https://www.debian.org/lts/security/2019/dla-2024
Note You need to log in before you can comment on or make changes to this bug.