Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 645700 (CVE-2017-1000499) - <dev-db/phpmyadmin-4.7.7: CSRF vulnerability can be used to deceive users into performing arbitrary database operations
Summary: <dev-db/phpmyadmin-4.7.7: CSRF vulnerability can be used to deceive users in...
Status: RESOLVED FIXED
Alias: CVE-2017-1000499
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://www.phpmyadmin.net/security/P...
Whiteboard: B4 [noglsa cve]
Keywords:
Depends on: CVE-2018-15605
Blocks:
  Show dependency tree
 
Reported: 2018-01-25 15:38 UTC by GLSAMaker/CVETool Bot
Modified: 2018-12-02 03:49 UTC (History)
2 users (show)

See Also:
Package list:
dev-db/phpmyadmin-4.7.7-r1
Runtime testing required: ---
stable-bot: sanity-check-

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2018-01-25 15:38:14 UTC 
CVE-2017-1000499 (https://nvd.nist.gov/vuln/detail/CVE-2017-1000499):
  phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF
  weakness. By deceiving a user to click on a crafted URL, it is possible to
  perform harmful database operations such as deleting records,
  dropping/truncating tables etc.
Comment 2 Jorge Manuel B. S. Vicetto (RETIRED) Gentoo Infrastructure gentoo-dev 2018-01-25 20:32:50 UTC 
@arch teams:

please proceed with marking dev-db/phpmyadmin-4.7.7 stable.
REQUESTED KEYWORDS: "alpha amd64 hppa ppc ppc64 x86"

@sparc:
Should we drop the stable keyword or do you want to add it to the 4.7.7 release?
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2018-02-07 06:37:52 UTC 
x86 stable
Comment 4 Agostino Sarubbo gentoo-dev 2018-02-09 08:40:10 UTC 
amd64 stable
Comment 5 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2018-02-21 15:18:06 UTC 
this bug was superseded by bug 648330
Comment 6 Tobias Klausmann (RETIRED) gentoo-dev 2018-03-06 13:33:40 UTC 
Stable on alpha.
Comment 7 Sergei Trofimovich (RETIRED) gentoo-dev 2018-03-30 20:21:04 UTC 
ppc64 stable
Comment 8 Matt Turner gentoo-dev 2018-04-22 20:44:53 UTC 
hppa stable keywords dropped
Comment 9 Rolf Eike Beer archtester 2018-06-12 05:41:39 UTC 
sparc will pick a newer version eventually.
Comment 10 Stabilization helper bot gentoo-dev 2018-06-23 10:00:33 UTC 
An automated check of this bug failed - the following atom is unknown:

dev-db/phpmyadmin-4.7.7-r1

Please verify the atom list.
Comment 11 Aaron Bauman (RETIRED) gentoo-dev 2018-11-24 22:38:14 UTC 
GLSA Vote: No
Comment 12 Aaron Bauman (RETIRED) gentoo-dev 2018-12-01 10:12:10 UTC 
(In reply to Jorge Manuel B. S. Vicetto from comment #1)
> https://gitweb.gentoo.org/repo/gentoo.git/commit/
> ?id=449d4a8250796576021f544d826cbd32f4c6c82d
> https://gitweb.gentoo.org/repo/gentoo.git/commit/
> ?id=66ce23a80efde30425899df6c59d3b8eca50124c
> https://gitweb.gentoo.org/repo/gentoo.git/commit/
> ?id=256846b1bbda408d41264d8984022b27ceb548b1
> 
> Apologies for taking so long, but I got distracted after losing my battle
> with gpg remote signing. I've dropped the old 4.7 versions (and restore back
> 4.7.0 as the last stable).
> 
> https://gitweb.gentoo.org/dev/jmbsvicetto.git/commit/
> ?id=e27ed9b11b540c2184f789828563df58572d12f0

Jorge, according to the PMASA 4.7.0 is vulnerable:

https://www.phpmyadmin.net/security/PMASA-2017-9/

Please drop it.
Comment 13 Larry the Git Cow gentoo-dev 2018-12-02 03:47:44 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5019cc7b54eb4bd2b33d0449446d0f3e6cd63f3c

commit 5019cc7b54eb4bd2b33d0449446d0f3e6cd63f3c
Author:     Jorge Manuel B. S. Vicetto (jmbsvicetto) <jmbsvicetto@gentoo.org>
AuthorDate: 2018-12-02 03:47:15 +0000
Commit:     Jorge Manuel B. S. Vicetto (jmbsvicetto) <jmbsvicetto@gentoo.org>
CommitDate: 2018-12-02 03:47:15 +0000

    dev-db/phpmyadmin: Drop vulnerable release.
    
    Bug: http://bugs.gentoo.org/645700
    Signed-off-by: Jorge Manuel B. S. Vicetto (jmbsvicetto) <jmbsvicetto@gentoo.org>
    Package-Manager: Portage-2.3.50, Repoman-2.3.11

 dev-db/phpmyadmin/Manifest                |  1 -
 dev-db/phpmyadmin/phpmyadmin-4.7.0.ebuild | 61 -------------------------------
 2 files changed, 62 deletions(-)
Comment 14 Aaron Bauman (RETIRED) gentoo-dev 2018-12-02 03:49:15 UTC 
(In reply to Larry the Git Cow from comment #13)
> The bug has been referenced in the following commit(s):
> 
> https://gitweb.gentoo.org/repo/gentoo.git/commit/
> ?id=5019cc7b54eb4bd2b33d0449446d0f3e6cd63f3c
> 
> commit 5019cc7b54eb4bd2b33d0449446d0f3e6cd63f3c
> Author:     Jorge Manuel B. S. Vicetto (jmbsvicetto) <jmbsvicetto@gentoo.org>
> AuthorDate: 2018-12-02 03:47:15 +0000
> Commit:     Jorge Manuel B. S. Vicetto (jmbsvicetto) <jmbsvicetto@gentoo.org>
> CommitDate: 2018-12-02 03:47:15 +0000
> 
>     dev-db/phpmyadmin: Drop vulnerable release.
>     
>     Bug: http://bugs.gentoo.org/645700
>     Signed-off-by: Jorge Manuel B. S. Vicetto (jmbsvicetto)
> <jmbsvicetto@gentoo.org>
>     Package-Manager: Portage-2.3.50, Repoman-2.3.11
> 
>  dev-db/phpmyadmin/Manifest                |  1 -
>  dev-db/phpmyadmin/phpmyadmin-4.7.0.ebuild | 61
> -------------------------------
>  2 files changed, 62 deletions(-)

Thank you, Jorge!