Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.1059
libphp-adodb security update
14 March 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: libphp-adodb
Publisher: Debian
Operating System: Debian GNU/Linux
Resolution: Patch/Upgrade
CVE Names: CVE-2021-3850
Original Bulletin:
https://lists.debian.org/debian-security-announce/2022/msg00068.html
Comment: CVSS (Max): 9.1 CVE-2021-3850 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS Source: NVD
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-5101-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
March 13, 2022 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : libphp-adodb
CVE ID : CVE-2021-3850
Debian Bug : 1004376
Emmet Leahy reported that libphp-adodb, a PHP database abstraction layer
library, allows to inject values into a PostgreSQL connection string.
Depending on how the library is used this flaw can result in
authentication bypass, reveal a server IP address or have other
unspecified impact.
For the oldstable distribution (buster), this problem has been fixed
in version 5.20.14-1+deb10u1.
For the stable distribution (bullseye), this problem has been fixed in
version 5.20.19-1+deb11u1.
We recommend that you upgrade your libphp-adodb packages.
For the detailed security status of libphp-adodb please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/libphp-adodb
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmIuA5pfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0TpVA//bYjd0FcCYTX2H6P0oFaaKYORpHb9YnGaXU/44hinNCzizRNOThHBWDQP
yhQrFjls6MuEYDCk3nfolJH/PMU3fShTpTtxWYOjgdnu1jqRIHD4A0hXMIXSR8Ru
1LS0oMcRjbnbM5uV/v+wDKCsor2PcdUMB0EQPu3Lv6o2rxJ5HaKRNjtk3tZWI3Xn
wo9i7ufVmyaOiPsgyYryAUnmi1wG9HLmKdHRNbOUH91SaZvV4Iu+6JExVm+NUn1W
tP5I+BC2VDcGVkFUKNUXAG0Ly35mytXNLlIGZ+ciJVJhJPEGBJQy1917FvhPkZdk
CR30PcIyJtKQ5ykrvBRuSMai0gCzy2R21JpgPTXOzQYTPO1KIjQgmXPZucsaVMbJ
XWBxV0mb+yi7He/qCkgqXFMJ8wSz4Wu2q+k+yeNmJdZryD0624uQCsykDi8tCMh3
IuA2nHJelpUOyei7M6sWa8MEbboBTMgvnyjcPEwGsC65OnmqOAFw3mG26YmLWLXM
Z4oKTGs1nQO1XP3tyOoKDDuY30Q8uq1k+6qOEKd/OIQNSAm+y7tEzRahIAbr7RyW
WoqtZE7JuOop+FxOVxFVuxK+/f4ItinN1swPYu4AMvxlaxauAzdsDdTYhk9vKkW0
RA3yGG/b8L4wYeekLwVTtaSLHpQnE1Oh6S9vMNqPX5VpFGHb5uA=
=/KVi
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYi57ueNLKJtyKPYoAQj/Zw//bRuAPAQNBgTFa9Je59z0ORUki0bnyU9m
HW+l9fynCXNTJPUGhSA2Vmd5Kdssdg70491WZeoqHAYfIR5etRa9RYwLnwwc0x/z
d4nl6MzZZ+FuVPKiyo8mN669iOVGbrTGaMgcX+AxgQlLQNXAUTXb4eP+YpJ15Tsu
AC1gj9o20EEzMK0RZixwLyuigmbmKgLcUiq7Alq7yponm7lJiJJRUPox0cekC11Y
pcR6sxXf7UoogdKZTfr7lWJnqflGCcKso0srN7xyrfvM0WCEd42j0hA2EvrgxKa1
IBj83wXq6lsCEuiprFDNp25hAveD0hbCZB+Y27RkRARrNMqfHKdkBJaIlzc/f8Ze
vo9UHnMjhGX9nUdn1KgrrQGNhGTrUU9abI92At5hZg7WBmjkKcIfBEd1jPcKDzOP
0PuYKA9Quw+bmIY6h/KlCSXdT4vlPJQVpDz072qNcmscYGDlruuJDqFScR4b2s+Z
pSmpki7vPH1KvHz1LTNwPYp4VhhrwZ781tXJFpdWK4F/EywyDPoG9it6+sYHVF0W
mwcm9zKUS0jRD61cailWeJO/X83BrCLSHYo2fJpBOFlR1O1GUQU3njJVvnbMBpxj
FGue4QFgH0aN8YfwRezGhcs7cJ94BggCgv6gIao64BAJ1WZPJAkuQENwKsXgjXdf
0Ra2LYYYyhc=
=teMb
-----END PGP SIGNATURE-----