phpmyadmin: CVE-2019-12616: PMASA-2019-4

Debian Bug report logs - #930017
phpmyadmin: CVE-2019-12616: PMASA-2019-4

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: phpmyadmin: CVE-2019-12616

Date: Wed, 05 Jun 2019 11:27:55 +0200

Source: phpmyadmin
Version: 4:4.6.6-4
Severity: grave
Tags: security upstream
Justification: user security hole
Control: found -1 4:4.6.6-5

Hi,

The following vulnerability was published for phpmyadmin.

CVE-2019-12616[0]:
| An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability
| was found that allows an attacker to trigger a CSRF attack against a
| phpMyAdmin user. The attacker can trick the user, for instance through
| a broken <img> tag pointing at the victim's phpMyAdmin database,
| and the attacker can potentially deliver a payload (such as a specific
| INSERT or DELETE statement) to the victim.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-12616
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12616
[1] https://www.phpmyadmin.net/security/PMASA-2019-4/

Regards,
Salvatore

Message #12 received at 930017@bugs.debian.org (full text, mbox, reply):

From: Matthias Blümel <blaimi@blaimi.de>

To: 930017@bugs.debian.org

Cc: Felipe Sateler <fsateler@debian.org>

Subject: updated merge-request with patches for PMASA-2019-{3,4}

Date: Thu, 06 Jun 2019 00:26:54 +0200

I updated the merge-request 
https://salsa.debian.org/phpmyadmin-team/phpmyadmin/merge_requests/6
with patches for stretch of the two new PMASA-2019-{3,4}

I also updated 
https://salsa.debian.org/phpmyadmin-team/phpmyadmin/merge_requests/5
for jessie and PMASA-2019-4 (CVE-2019-12616)

PMASA-2019-3 (CVE-2019-11768) does not affect jessie. This bug came
with 
https://github.com/phpmyadmin/phpmyadmin/commit/e04f56a04f506c1a0a884c81c209ae2ffbf80baf
in PhpMyAdmin 4.3.0alpha1

PMASA-2019-3 (CVE-2019-11768) does not yet have a debian-bug. how
should this be done? by the security-team via the security-tracker? can
I do this? how do i reference all the stuff?

BTW: Why is jessie mentioned in the security-tracker of this CVE but
not in this bug?

Send a report that this bug log contains spam.