GHSA-pgph-mc4p-f8c3

phpMyAdmin unsanitized Git information

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-19617

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	phpmyadmin/phpmyadmin	< 4.9.2	4.9.2

Details

As written in the advisory (Markdown source, shown as plain text).

phpMyAdmin before 4.9.2 does not escape certain Git information, related to `libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php`.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-19617 advisory
https://github.com/phpmyadmin/phpmyadmin/commit/1119de642b136d20e810bb20f545069a01dd7cc9 web
https://github.com/phpmyadmin/composer package
https://github.com/phpmyadmin/phpmyadmin/compare/RELEASE_4_9_1...RELEASE_4_9_2 web
https://lists.debian.org/debian-lts-announce/2019/12/msg00006.html web
https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html web
https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released web