ALT-BU-2020-3601-2

Branch sisyphus update bulletin.

Package veyon updated to version 4.2.5-alt2 for branch sisyphus in task 244337.

veyon-configurator не запускается из под обычного пользователя.

Package http-parser updated to version 2.9.2-alt2 for branch sisyphus in task 244392.

Отсутствует pc-файл для сборки

Package phpMyAdmin updated to version 5.0.1-alt1 for branch sisyphus in task 244410.

In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.

Severity: MEDIUM (6.5)Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.

Severity: MEDIUM (4.0)Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N

Severity: MEDIUM (4.3)Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References:

Improper Authentication in phpmyadmin

Severity: MEDIUM (4.3)Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References:

phpMyAdmin SQL injection in user accounts page

Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Version: 2.1.2

Branch sisyphus update on 2020-01-17

ALT-BU-2020-3601-2

ALT-PU-2020-1053-1

Closed bugs

Bug #37651

ALT-PU-2020-1060-1

Closed bugs

Bug #37698

ALT-PU-2020-1061-2

Closed vulnerabilities

CVE-2020-5504

CVE-2022-23807

GHSA-8wf2-3ggj-78q9

GHSA-fgj8-93xx-f6g6