Advisories » MGASA-2022-0257

Updated pgadmin4 packages fix security vulnerability

Publication date: 13 Jul 2022
Modification date: 13 Jul 2022
Type: security
Affected Mageia releases : 8
CVE: CVE-2022-0959

Description

A malicious, but authorised and authenticated user can construct an HTTP
request using their existing CSRF token and session cookie to manually
upload files to any location that the operating system user account under
which pgAdmin is running has permission to write. (CVE-2022-0959)

In addition, missing requires have been added, file and directory
permissions have been corrected. Upstream update check disabled.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=30385
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JSL3A3EFXELNQREOPMKA3CGCYH5WGQXK/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0959

SRPMS

8/core

• pgadmin4-4.30-5.mga8