Bug 1198794 (CVE-2015-2206)

Summary:	CVE-2015-2206 phpMyAdmin: Risk of BREACH attack due to reflected parameter (PMASA-2015-1)
Product:	[Other] Security Response	Reporter:	Robert Scheck <redhat-bugzilla>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jrusnack, vkaigoro
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	phpMyAdmin 4.0.10.9, phpMyAdmin 4.2.13.2, phpMyAdmin 4.3.11.1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-28 14:54:13 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1199195, 1199196
Bug Blocks:

Description Robert Scheck 2015-03-04 20:22:35 UTC

Risk of BREACH attack due to reflected parameter has been reported [1] for
phpMyAdmin.

[1]: http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php

Comment 1 Vasyl Kaigorodov 2015-03-05 15:34:25 UTC

4.2.x upstream commit: https://github.com/phpmyadmin/phpmyadmin/commit/d0f109dfe3b345094d7ceb49df0dbb68efc032ed
4.0.x upstream commit: https://github.com/phpmyadmin/phpmyadmin/commit/e1a68ad02c5b1a516b3787ce114ef6a6be004630

Comment 2 Fedora Update System 2015-03-09 08:35:43 UTC

phpMyAdmin-4.3.11.1-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2015-03-14 09:21:22 UTC

phpMyAdmin-4.3.11.1-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2015-03-14 09:22:54 UTC

phpMyAdmin-4.3.11.1-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2015-03-15 01:01:15 UTC

phpMyAdmin-4.3.11.1-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2015-03-25 19:55:24 UTC

phpMyAdmin4-4.0.10.9-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2015-03-25 20:06:21 UTC

phpMyAdmin-4.0.10.9-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.