Bug 26372 - phpmyadmin new security issues CVE-2020-1080[2-4]
Summary: phpmyadmin new security issues CVE-2020-1080[2-4]
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2020-03-22 17:03 CET by David Walser
Modified: 2020-04-01 03:58 CEST (History)
5 users (show)

See Also:
Source RPM: phpmyadmin-4.9.4-1.mga7.src.rpm
CVE:
Status comment:


Attachments

David Walser 2020-03-22 17:04:08 CET

Whiteboard: (none) => MGA7TOO

Comment 1 Marc Krämer 2020-03-23 21:21:24 CET
Updated phpmyadmin packages fix security vulnerabilities:

Some SQL injections via table names and parameters were fixed.
 

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10802
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10803
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10804
https://www.phpmyadmin.net/news/2020/3/21/phpmyadmin-495-and-502-are-released/
========================

Updated packages in core/updates_testing:
========================
phpmyadmin-4.9.5-1.mga7.noarch.rpm


SRPM:
phpmyadmin-4.9.5-1.mga7.src.rpm

Assignee: mageia => qa-bugs

Thomas Backlund 2020-03-24 17:57:03 CET

Version: Cauldron => 7
Whiteboard: MGA7TOO => (none)
CC: (none) => tmb

Comment 2 David Walser 2020-03-24 23:43:03 CET
Debian has issued an advisory for this on March 22:
https://www.debian.org/lts/security/2020/dla-2154

Source RPM: phpmyadmin-5.0.1-2.mga8.src.rpm, phpmyadmin-4.9.4-1.mga7.src.rpm => phpmyadmin-4.9.4-1.mga7.src.rpm

Comment 3 Herman Viaene 2020-03-25 11:08:47 CET
MGA7-64 Plasma on Lenovo B50
No installation issues
Tested by connection to existing mysql installation, created a new database in it, created a new table wit two indexes, added a row of data, deleted the table and the database, all worked OK.
Good for me.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA7-64-OK

Comment 4 Thomas Andrews 2020-03-25 16:29:06 CET
Validating. Advisory information in Comment 1.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Dave Hodgins 2020-03-31 23:22:28 CEST

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 5 Mageia Robot 2020-04-01 03:58:30 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2020-0150.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.