-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2020-e60ce63865 2020-04-01 16:31:17.044850 --------------------------------------------------------------------------------
Name : phpMyAdmin Product : Fedora 32 Version : 5.0.2 Release : 2.fc32 URL : https://www.phpmyadmin.net/ Summary : A web interface for MySQL and MariaDB Description : phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the Web. Currently it can create and drop databases, create/drop/alter tables, delete/edit/add fields, execute any SQL statement, manage keys on fields, manage privileges,export data into various formats and is available in 50 languages
-------------------------------------------------------------------------------- Update Information:
The **phpMyAdmin** team announces the release of both **4.9.5** and **5.0.2**. Both versions contain several security fixes: * PMASA-2020-2 SQL injection vulnerability in the user accounts page, particularly when changing a password * PMASA-2020-3 SQL injection vulnerability relating to the search feature * PMASA-2020-4 SQL injection and XSS having to do with displaying results * Removing of the "options" field for the external transformation. There are many other bugs fixes, please see the ChangeLog file included with this release for full details. -------------------------------------------------------------------------------- ChangeLog:
* Tue Mar 24 2020 Remi Collet remi@remirepo.net 5.0.2-2 - cleanup httpd configuration * Sat Mar 21 2020 Remi Collet remi@remirepo.net 5.0.2-1 - update to 5.0.2 (2020-03-21, security release) - use phpmyadmin/twig-i18n-extension instead of twig/extensions -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1816097 - CVE-2020-10804 phpMyAdmin: SQL injection was found in retrieval of the current username which could result privilege escalation https://bugzilla.redhat.com/show_bug.cgi?id=1816097 [ 2 ] Bug #1816131 - CVE-2020-10803 phpMyAdmin: Inserting specially crafted code in database tables, retrieving and displaying resuts could result in XSS https://bugzilla.redhat.com/show_bug.cgi?id=1816131 [ 3 ] Bug #1816144 - CVE-2020-10802 phpMyAdmin: SQL injection was found in generating certain queries for search actions which could result in malicious D M https://bugzilla.redhat.com/show_bug.cgi?id=1816144 --------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-e60ce63865' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------
package-announce@lists.fedoraproject.org
-
updates＠fedoraproject.org