Bug 2491333 - CVE-2026-48774 proxysql: ProxySQL: Unauthorized write operations via insufficient SQL statement validation. [fedora-all]
Summary: CVE-2026-48774 proxysql: ProxySQL: Unauthorized write operations via insuffic...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: proxysql
Version: rawhide
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Orphan Owner
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["610e0267-7233-4950-a6d4-d...
Depends On:
Blocks: CVE-2026-48774
TreeView+ depends on / blocked
 
Reported: 2026-06-22 12:54 UTC by Keith Grant
Modified: 2026-07-22 05:23 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-07-22 05:23:50 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
spec (5.86 KB, text/x-rpm-spec)
2026-06-22 21:51 UTC, SisyphusCode
no flags Details
sources (162 bytes, text/plain)
2026-06-22 21:52 UTC, SisyphusCode
no flags Details
Submitted SRPM build to Copr (198 bytes, text/plain)
2026-06-22 22:10 UTC, SisyphusCode
no flags Details

Description Keith Grant 2026-06-22 12:54:36 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Comment 1 SisyphusCode 2026-06-22 21:43:32 UTC
I prepared a proxysql 3.0.9 update for Rawhide to address this CVE and would like to
  adopt the orphaned package. I am not yet in the packager group and need a sponsor.
  Update summary

  * Bumped proxysql from 3.0.2 to 3.0.9 (fixes CVE-2026-48774 upstream in 3.0.9)
  * Refreshed Fedora patches for upstream 3.0.9 build-system changes
  * OpenSSL 3 / Rawhide compile fixes retained
  * Local mock build succeeded: proxysql-3.0.9-1.fc45.x86_64
  Dist-git / review
 
  * Fork MR: https://src.fedoraproject.org/rpms/proxysql/pull-request/15
  * Commits: https://src.fedoraproject.org/fork/sisyphuscode/rpms/proxysql/commits/rawhide
  * Merge status: fast-forward, 2 commits
  Build status
  
  * Local mock (fedora-rawhide-x86_64): SUCCESS
  * Koji/Packit task 146950356: FAILED at source retrieval — I cannot upload to the
    lookaside cache (fedpkg new-sources returns 403; no commit ACL on rpms/proxysql).
    The sources file in the MR has the correct SHA512; a maintainer/sponsor upload
    of proxysql-3.0.9.tar.gz is still needed before Koji can build.
  Attached
 
  * proxysql-3.0.9-1.fc45.src.rpm (mock-built SRPM for review)
  Sponsorship request

  proxysql is currently orphaned. I would like to maintain it going forward and
  request sponsorship to join the packagers group. Happy to walk through the spec,
  patches, and mock build with a sponsor.
  Thank you.

Comment 2 SisyphusCode 2026-06-22 21:51:48 UTC
Created attachment 2146274 [details]
spec

Comment 3 SisyphusCode 2026-06-22 21:52:31 UTC
Created attachment 2146275 [details]
sources

Comment 4 SisyphusCode 2026-06-22 22:10:26 UTC
Created attachment 2146276 [details]
Submitted SRPM build to Copr

Comment 5 SisyphusCode 2026-06-22 22:19:59 UTC
For immediate testing or mitigation, the successful build is available here: 
https://copr.fedorainfracloud.org/coprs/sisyphuscode/proxysql/

Comment 6 Maxwell G 2026-07-22 05:23:50 UTC
Automation has figured out the package is retired in Fedora Rawhide.

If you like it to be unretired, please open a ticket at
https://forge.fedoraproject.org/releng/tickets/issues/new?template=.forgejo%2fISSUE_TEMPLATE%2funretire-package.md


Note You need to log in before you can comment on or make changes to this bug.