Bug 2491333
| Summary: | CVE-2026-48774 proxysql: ProxySQL: Unauthorized write operations via insufficient SQL statement validation. [fedora-all] | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Keith Grant <kgrant> | ||||||||
| Component: | proxysql | Assignee: | Orphan Owner <extras-orphan> | ||||||||
| Status: | CLOSED WONTFIX | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||||
| Severity: | high | Docs Contact: | |||||||||
| Priority: | high | ||||||||||
| Version: | rawhide | CC: | acaringi, extras-orphan, hhorak, mschorm, SisyphusCode | ||||||||
| Target Milestone: | --- | Keywords: | Security, SecurityTracking | ||||||||
| Target Release: | --- | ||||||||||
| Hardware: | Unspecified | ||||||||||
| OS: | Unspecified | ||||||||||
| Whiteboard: | {"flaws": ["610e0267-7233-4950-a6d4-d467773cea00"]} | ||||||||||
| Fixed In Version: | Doc Type: | --- | |||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2026-07-22 05:23:50 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Bug Depends On: | |||||||||||
| Bug Blocks: | 2490893 | ||||||||||
| Attachments: |
|
||||||||||
|
Description
Keith Grant
2026-06-22 12:54:36 UTC
I prepared a proxysql 3.0.9 update for Rawhide to address this CVE and would like to adopt the orphaned package. I am not yet in the packager group and need a sponsor. Update summary * Bumped proxysql from 3.0.2 to 3.0.9 (fixes CVE-2026-48774 upstream in 3.0.9) * Refreshed Fedora patches for upstream 3.0.9 build-system changes * OpenSSL 3 / Rawhide compile fixes retained * Local mock build succeeded: proxysql-3.0.9-1.fc45.x86_64 Dist-git / review * Fork MR: https://src.fedoraproject.org/rpms/proxysql/pull-request/15 * Commits: https://src.fedoraproject.org/fork/sisyphuscode/rpms/proxysql/commits/rawhide * Merge status: fast-forward, 2 commits Build status * Local mock (fedora-rawhide-x86_64): SUCCESS * Koji/Packit task 146950356: FAILED at source retrieval — I cannot upload to the lookaside cache (fedpkg new-sources returns 403; no commit ACL on rpms/proxysql). The sources file in the MR has the correct SHA512; a maintainer/sponsor upload of proxysql-3.0.9.tar.gz is still needed before Koji can build. Attached * proxysql-3.0.9-1.fc45.src.rpm (mock-built SRPM for review) Sponsorship request proxysql is currently orphaned. I would like to maintain it going forward and request sponsorship to join the packagers group. Happy to walk through the spec, patches, and mock build with a sponsor. Thank you. Created attachment 2146274 [details]
spec
Created attachment 2146275 [details]
sources
Created attachment 2146276 [details]
Submitted SRPM build to Copr
For immediate testing or mitigation, the successful build is available here: https://copr.fedorainfracloud.org/coprs/sisyphuscode/proxysql/ Automation has figured out the package is retired in Fedora Rawhide. If you like it to be unretired, please open a ticket at https://forge.fedoraproject.org/releng/tickets/issues/new?template=.forgejo%2fISSUE_TEMPLATE%2funretire-package.md |