Bug 1117545 (CVE-2014-4914)

Summary: CVE-2014-4914 Zend FrameWork: ZF2014-04: Potential SQL injection in the ORDER implementation of Zend_Db_Select
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: fedora, felix, jrusnack
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-08-17 10:42:40 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1117546, 1117547, 1117548    
Bug Blocks:    

Description Kurt Seifried 2014-07-08 23:05:06 UTC
Zend reports:

ZF2014-04: Potential SQL injection in the ORDER implementation of 
Zend_Db_Select

The implementation of the ORDER BY SQL statement in Zend_Db_Select of Zend 
Framework 1 contains a potential SQL injection when the query string passed 
contains parentheses.

External references:
http://framework.zend.com/security/advisory/ZF2014-04

Comment 1 Kurt Seifried 2014-07-08 23:05:47 UTC
Created php-ZendFramework tracking bugs for this issue:

Affects: fedora-all [bug 1117546]

Comment 2 Kurt Seifried 2014-07-08 23:05:57 UTC
Created php-ZendFramework tracking bugs for this issue:

Affects: epel-5 [bug 1117547]

Comment 3 Kurt Seifried 2014-07-08 23:06:05 UTC
Created php-ZendFramework tracking bugs for this issue:

Affects: epel-6 [bug 1117548]

Comment 4 Fedora Update System 2014-07-22 03:29:45 UTC
php-ZendFramework-1.12.7-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2014-07-22 03:32:28 UTC
php-ZendFramework-1.12.7-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2014-07-27 17:40:39 UTC
php-ZendFramework-1.12.7-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.