phpmyadmin: CVE-2020-10802

Debian Bug report logs - #954665
phpmyadmin: CVE-2020-10802

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: phpmyadmin: CVE-2020-10802

Date: Sun, 22 Mar 2020 14:14:40 +0100

Source: phpmyadmin
Version: 4:4.9.4+dfsg1-1
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for phpmyadmn.

CVE-2020-10802[0]:
| In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection
| vulnerability has been discovered where certain parameters are not
| properly escaped when generating certain queries for search actions in
| libraries/classes/Controllers/Table/TableSearchController.php. An
| attacker can generate a crafted database or table name. The attack can
| be performed if a user attempts certain search operations on the
| malicious database or table.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-10802
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10802
[1] https://www.phpmyadmin.net/security/PMASA-2020-3/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Send a report that this bug log contains spam.