Bug 2035267 (CVE-2021-43608)

Summary:	CVE-2021-43608 php-doctrine-dbal: SQL Injection
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	ce, fedora, shawn
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	php-doctrine-dbal 3.1.4	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2035268, 2035269
Bug Blocks:

Description Marian Rehak 2021-12-23 12:34:53 UTC

The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.

Upstream Reference:

https://github.com/doctrine/dbal/security/advisories/GHSA-r7cj-8hjg-x622
https://github.com/doctrine/dbal/releases

Comment 1 Marian Rehak 2021-12-23 12:35:10 UTC

Created php-doctrine-dbal tracking bugs for this issue:

Affects: epel-7 [bug 2035269]
Affects: fedora-all [bug 2035268]