Mageia 2022-0257: pgadmin4 security update | LinuxSecurity.com

Advisories

MGASA-2022-0257 - Updated pgadmin4 packages fix security vulnerability

Publication date: 13 Jul 2022
URL: https://advisories.mageia.org/MGASA-2022-0257.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2022-0959

A malicious, but authorised and authenticated user can construct an HTTP
request using their existing CSRF token and session cookie to manually
upload files to any location that the operating system user account under
which pgAdmin is running has permission to write. (CVE-2022-0959)

In addition, missing requires have been added, file and directory
permissions have been corrected. Upstream update check disabled.

References:
- https://bugs.mageia.org/show_bug.cgi?id=30385
- https://lists.opensuse.org/archives/list/[email protected]/thread/JSL3A3EFXELNQREOPMKA3CGCYH5WGQXK/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0959

SRPMS:
- 8/core/pgadmin4-4.30-5.mga8

Mageia 2022-0257: pgadmin4 security update

A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that th...

Summary

A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write. (CVE-2022-0959)
In addition, missing requires have been added, file and directory permissions have been corrected. Upstream update check disabled.

References

- https://bugs.mageia.org/show_bug.cgi?id=30385

- https://lists.opensuse.org/archives/list/[email protected]/thread/JSL3A3EFXELNQREOPMKA3CGCYH5WGQXK/

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0959

Resolution

MGASA-2022-0257 - Updated pgadmin4 packages fix security vulnerability

SRPMS

- 8/core/pgadmin4-4.30-5.mga8

Severity
Publication date: 13 Jul 2022
URL: https://advisories.mageia.org/MGASA-2022-0257.html
Type: security
CVE: CVE-2022-0959