Bugzilla – Bug 930993
VUL-1: CVE-2015-3903: phpMyAdmin: Vulnerability allowing man-in-the-middle attack on API call to GitHub (PMASA-2015-3)
Last modified: 2015-07-06 11:31:22 UTC
http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php Announcement-ID: PMASA-2015-3 Date: 2015-05-13 Summary: Vulnerability allowing man-in-the-middle attack on API call to GitHub. Description A vulnerability in the API call to GitHub can be exploited to perform a man-in-the-middle attack. Severity: We consider this vulnerability to be serious. Affected Versions: Versions 4.0.x (prior to 4.0.10.10), 4.2.x (prior to 4.2.13.3), 4.3.x (prior to 4.3.13.1) and 4.4.x (prior to 4.4.6.1) are affected. Solution Upgrade to phpMyAdmin 4.0.10.10 or newer, or 4.2.13.3 or newer, or 4.3.13.1 or newer, or 4.4.6.1 or newer, or apply the patch listed below. References Thanks to Maksymilian Arciemowicz of http://cxsecurity.com for reporting this vulnerability. Assigned CVE ids: CVE-2015-3903 CWE ids: CWE-661 CWE-295 Patches The following commits have been made to fix this issue: 5ebc4daf131dd3bd646326267f3e765d0249bbb4 The following commits have been made on the 4.3 branch to fix this issue: 75499e790429c491840a0ad31d4de84aca215d23 The following commits have been made on the 4.2 branch to fix this issue: 0e18931d9e4b23053285b6fddf3493ca426ff684 The following commits have been made on the 4.0 branch to fix this issue: e97e7fb0ea2dedfaa95c7dbe872027fb4bd4204c References: https://bugzilla.redhat.com/show_bug.cgi?id=1221581 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3903 http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-3903.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3903 Already fixed in server:php:applications / phpMyAdmin Update for 13.1 and 13.2 pending. Eric if you are interested you can submit this as a maintenance update, we can assist you, or I can handle the update for the distribution.
bugbot adjusting priority
taking for a security maintenance update
This is an autogenerated message for OBS integration: This bug (930993) was mentioned in https://build.opensuse.org/request/show/313850 13.2+13.1 / phpMyAdmin
openSUSE-SU-2015:1191-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 920773,930992,930993 CVE References: CVE-2015-2206,CVE-2015-3902,CVE-2015-3903 Sources used: openSUSE 13.2 (src): phpMyAdmin-4.2.13.3-11.1 openSUSE 13.1 (src): phpMyAdmin-4.2.13.3-31.1
released