Bug 1151277 (CVE-2014-8089)

Summary:	CVE-2014-8089 php-ZendFramework: SQL injection issue when using the sqlsrv PHP extension (ZF2014-06)
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fedora, felix, fweimer, jrusnack, mmcallis, shawn, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Zend Framework 1.12.9, Zend Framework 2.2.8, Zend Framework 2.3.3	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-01-03 15:44:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1151278, 1151279, 1151280, 1151281
Bug Blocks:

Description Murray McAllister 2014-10-10 03:10:27 UTC

The 1.12.9, 2.2.8, and 2.3.3 releases of the Zend Framework fix an SQL injection issue when using the sqlsrv PHP extension. Full details are available in the upstream advisory.

For the php-ZendFramework packages (not php-ZendFramework2) in Fedora 19 and 20, the fixed version is already in the testing repositories.

References:

http://framework.zend.com/security/advisory/ZF2014-06
http://framework.zend.com/blog/zend-framework-1-12-9-2-2-8-and-2-3-3-released.html

Comment 1 Murray McAllister 2014-10-10 03:13:25 UTC

Created php-ZendFramework2 tracking bugs for this issue:

Affects: fedora-all [bug 1151278]
Affects: epel-6 [bug 1151280]
Affects: epel-7 [bug 1151281]

Comment 2 Murray McAllister 2014-10-10 03:13:27 UTC

Created php-ZendFramework tracking bugs for this issue:

Affects: epel-6 [bug 1151279]

Comment 3 Murray McAllister 2014-10-10 03:21:57 UTC

CVE request: http://www.openwall.com/lists/oss-security/2014/10/10/2

Comment 4 Fedora Update System 2014-10-16 02:00:15 UTC

php-ZendFramework2-2.3.3-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2014-10-17 08:37:23 UTC

php-ZendFramework-1.12.9-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2014-10-17 08:42:22 UTC

php-ZendFramework-1.12.9-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2014-10-28 06:44:58 UTC

php-ZendFramework2-2.3.3-2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2014-10-28 11:01:36 UTC

php-ZendFramework-1.12.9-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2014-10-28 11:02:56 UTC

php-ZendFramework2-2.3.3-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2014-11-01 16:20:06 UTC

php-ZendFramework-1.12.9-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2014-11-10 06:49:21 UTC

php-ZendFramework2-2.2.8-2.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2014-11-16 04:15:23 UTC

php-ZendFramework2-2.2.8-2.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 Shawn Iwinski 2015-01-03 05:08:43 UTC

All dependent bugs have been addressed and are closed.  Can this bug be closed?

Comment 14 Felix Kaechele 2015-01-03 15:44:17 UTC

Thanks for the hint!