A vulnerability in phpMyAdmin might allow remote attackers to bypass authentication.
|Package||dev-db/phpmyadmin on all architectures|
|Affected versions||< 220.127.116.11
|Unaffected versions||>= 18.104.22.168
phpMyAdmin is a web-based management tool for MySQL databases.
A vulnerability was discovered where the restrictions caused by “$cfg[‘Servers’][$i][‘AllowNoPassword’] = false” are bypassed under certain PHP versions. This can lead compromised user accounts, who have no passwords set, even if the administrator has set “$cfg[‘Servers’][$i][‘AllowNoPassword’]” to false (which is the default).
This behavior depends on the PHP version used (it seems PHP 5 is affected, while PHP 7.0 is not).
A remote attacker, who only needs to know the username, could bypass security restrictions and access phpMyAdmin.
Set a password for all users.
All phpMyAdmin 4.0.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-db/phpmyadmin-22.214.171.124:126.96.36.199"
All other phpMyAdmin users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-db/phpmyadmin-4.7.0:4.7.0"
July 08, 2017
August 06, 2017: 2