Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 30 Sep 2015 16:23:31 +0200
From: Alessandro Ghedini <alessandro@...dini.me>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: CVE Request: zendframework SQL injections

On Wed, Sep 30, 2015 at 12:55:45PM +0200, Alessandro Ghedini wrote:
> Hello,
> 
> the Zendframework project released the following advisory:
> 
> > ZF2015-08: Potential SQL injection vector using null byte for PDO (MsSql, SQLite)
> http://framework.zend.com/security/advisory/ZF2015-08
> 
> The patch for the MS SQL backend seems to be:
> https://github.com/zendframework/zf1/commit/2ac9c30f73ec2e6235c602bed745749a551b4fe2
> 
> but I couldn't find the fix for the mentioned SQLite backend.

It was pointed out to me that that patch also includes changes for the file
library/Zend/Db/Adapter/Pdo/Abstract.php, which is used by the SQLite backend.
So it should cover both MS SQL *and* SQLite.

Cheers

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.