Bug 1221580 (CVE-2015-3902)

Summary: CVE-2015-3902 phpMyAdmin: XSRF/CSRF vulnerability in phpMyAdmin setup
Product: [Other] Security Response Reporter: Robert Scheck <redhat-bugzilla>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: jrusnack
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
URL: http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php
Whiteboard:
Fixed In Version: phpMyAdmin 4.0.10.10, phpMyAdmin 4.2.13.3, phpMyAdmin 4.3.13.1, phpMyAdmin 4.4.6.1 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-11-28 14:53:56 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1221418, 1221588, 1222607, 1222608, 1222609    
Bug Blocks:    

Description Robert Scheck 2015-05-14 11:58:17 UTC 
By deceiving a user to click on a crafted URL, it is possible to alter the 
configuration file being generated with phpMyAdmin setup. Versions 4.0.x
(prior to 4.0.10.10), 4.2.x (prior to 4.2.13.3), 4.3.x (prior to 4.3.13.1)
and 4.4.x (prior to 4.4.6.1) are affected.
Comment 1 Fedora Update System 2015-05-17 06:39:29 UTC 
phpMyAdmin-4.4.6.1-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 2 Fedora Update System 2015-05-17 06:44:02 UTC 
phpMyAdmin-4.4.6.1-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 3 Martin Prpič 2015-05-18 15:33:07 UTC 
External References:

http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php
Comment 5 Martin Prpič 2015-05-18 15:34:04 UTC 
Created phpMyAdmin tracking bugs for this issue:

Affects: epel-7 [bug 1222608]
Comment 6 Martin Prpič 2015-05-18 15:34:05 UTC 
Created phpMyAdmin4 tracking bugs for this issue:

Affects: epel-5 [bug 1222607]
Comment 7 Fedora Update System 2015-05-20 04:53:02 UTC 
phpMyAdmin-4.0.10.10-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2015-05-20 04:56:03 UTC 
phpMyAdmin-4.4.6.1-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2015-05-26 03:43:44 UTC 
phpMyAdmin-4.4.6.1-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2015-05-29 21:48:06 UTC 
phpMyAdmin4-4.0.10.10-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.