[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Add commit for adminer which disalowss connecting to privileged ports

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
3988977e by Salvatore Bonaccorso at 2018-03-19T18:57:38+01:00
Add commit for adminer which disalowss connecting to privileged ports

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -2551,7 +2551,9 @@ CVE-2018-7668 (TestLink through 1.9.16 allows remote attackers to read arbitrary
 CVE-2018-7667 (Adminer through 4.3.1 has SSRF via the server parameter. ...)
 	- adminer <unfixed>
 	NOTE: http://hyp3rlinx.altervista.org/advisories/ADMINER-UNAUTHENTICATED-SERVER-SIDE-REQUEST-FORGERY.txt
-	NOTE: adminer 4.4.0 disallows connecting to privileged ports
+	NOTE: https://github.com/vrana/adminer/commit/0fae40fb611b5c8167fa2b8d40bf576a8935a380
+	NOTE: adminer 4.4.0 disallows connecting to privileged ports, and thus not "enumerating"
+	NOTE: services on (another) host for ports < 1024.
 CVE-2018-7666 (An issue was discovered in ClipBucket before 4.0.0 Release 4902. SQL ...)
 	NOT-FOR-US: ClipBucket
 CVE-2018-7665 (An issue was discovered in ClipBucket before 4.0.0 Release 4902. A ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/3988977e3c1d1a469c6cace3cfe9615bf7133d59

---
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/3988977e3c1d1a469c6cace3cfe9615bf7133d59
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/secure-testing-commits/attachments/20180319/60674b10/attachment.html>