Bug 780132 (CVE-2021-27973)

Summary:	<www-apps/piwigo-11.4.0: sql injection via admin.php
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	trivial	CC:	voyageur
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/Piwigo/Piwigo/issues/1352
Whiteboard:	~4 [noglsa]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2021-04-05 00:40:27 UTC

CVE-2021-27673:

SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.


Please cleanup.

Comment 1 Larry the Git Cow gentoo-dev

2021-04-05 16:51:30 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c523bc7f115e6bbd41322e7ad94d22d23cb25ee5

commit c523bc7f115e6bbd41322e7ad94d22d23cb25ee5
Author:     Bernard Cafarelli <voyageur@gentoo.org>
AuthorDate: 2021-04-05 16:50:37 +0000
Commit:     Bernard Cafarelli <voyageur@gentoo.org>
CommitDate: 2021-04-05 16:51:05 +0000

    www-apps/piwigo: security cleanup
    
    Bug: https://bugs.gentoo.org/780132
    Package-Manager: Portage-3.0.18, Repoman-3.0.3
    Signed-off-by: Bernard Cafarelli <voyageur@gentoo.org>

 www-apps/piwigo/Manifest             |  1 -
 www-apps/piwigo/piwigo-11.3.0.ebuild | 44 ------------------------------------
 2 files changed, 45 deletions(-)

Comment 2 John Helmert III archtester

2021-04-05 17:21:48 UTC

Thanks! All done