[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150930142331.GA18445@kronk.local>
Date: Wed, 30 Sep 2015 16:23:31 +0200
From: Alessandro Ghedini <alessandro@...dini.me>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: CVE Request: zendframework SQL injections
On Wed, Sep 30, 2015 at 12:55:45PM +0200, Alessandro Ghedini wrote:
> Hello,
>
> the Zendframework project released the following advisory:
>
> > ZF2015-08: Potential SQL injection vector using null byte for PDO (MsSql, SQLite)
> http://framework.zend.com/security/advisory/ZF2015-08
>
> The patch for the MS SQL backend seems to be:
> https://github.com/zendframework/zf1/commit/2ac9c30f73ec2e6235c602bed745749a551b4fe2
>
> but I couldn't find the fix for the mentioned SQLite backend.
It was pointed out to me that that patch also includes changes for the file
library/Zend/Db/Adapter/Pdo/Abstract.php, which is used by the SQLite backend.
So it should cover both MS SQL *and* SQLite.
Cheers
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
