openSUSE-SU-2020:1806-1
Security update for phpMyAdmin
Severidad por fuente
Ninguna fuente da una puntuación CVSS.
La etiqueta propia de Trivy es CRITICAL. Crítica según SUSE.
Descripción
This update for phpMyAdmin fixes the following issues: phpMyAdmin was updated to 4.9.7 (boo#1177842): * Fix two factor authentication that was broken in 4.9.6 * Fix incompatibilities with older PHP versions Update to 4.9.6: - Fixed XSS relating to the transformation feature (boo#1177561 CVE-2020-26934, PMASA-2020-5) - Fixed SQL injection vulnerability in SearchController (boo#1177562 CVE-2020-26935, PMASA-2020-6) Update to 4.9.5: This is a security release containing several bug fixes. * CVE-2020-10804: SQL injection vulnerability in the user accounts page, particularly when changing a password (boo#1167335, PMASA-2020-2) * CVE-2020-10802: SQL injection vulnerability relating to the search feature (boo#1167336, PMASA-2020-3) * CVE-2020-10803: SQL injection and XSS having to do with displaying results (boo#1167337, PMASA-2020-4) * Removing of the 'options' field for the external transformation.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| openSUSE Leap 15.1 | phpMyAdmin | 4.9.7-bp151.3.24.1 |
Referencias
- https://bugzilla.suse.com/1167335
- https://bugzilla.suse.com/1167336
- https://bugzilla.suse.com/1167337
- https://bugzilla.suse.com/1177561
- https://bugzilla.suse.com/1177562
- https://bugzilla.suse.com/1177842
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KALR6PYMDCEFCQ6GUH5PGVPKTXVHV3YS/
- https://www.suse.com/security/cve/CVE-2020-10802/