Summary: | [CVE-2025-22954] SQL Injection in lateissues-export.pl | ||
---|---|---|---|
Product: | Koha | Reporter: | Zeyad Alshahrani <zeyadbinkhalid> |
Component: | Serials | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | RESOLVED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | critical | ||
Priority: | P5 - low | CC: | dcook, didier.gautheron, fridolin.somers, jesse, jonathan.druart, katrin.fischer, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, paul.derscheid, philippe.blouin, tomascohen, wainuiwitikapark |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | Small patch | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: |
25.05.00,24.11.02,24.05.07,23.11.12,22.11.24
|
Circulation function: | |
Bug Depends on: | |||
Bug Blocks: | 39915 | ||
Attachments: |
Bug 38829: Add a test
Bug 38829: Sanitize GetLateOrMissingIssues inputs Bug 38829: Add a test Bug 38829: Sanitize GetLateOrMissingIssues inputs Bug 38829: Add a test Bug 38829: Sanitize GetLateOrMissingIssues inputs Bug 38829: Sanitize GetLateOrMissingIssues inputs |
Description
Zeyad Alshahrani
2025-01-06 10:29:09 UTC
P.S: I requested a CVE 2 days ago. Best regards. Moving to Koha Security Created attachment 176149 [details] [review] Bug 38829: Add a test Created attachment 176150 [details] [review] Bug 38829: Sanitize GetLateOrMissingIssues inputs Thanks for the quick work so far! Created attachment 176171 [details] [review] Bug 38829: Add a test Signed-off-by: Magnus Enger <magnus@libriotech.no> Created attachment 176172 [details] [review] Bug 38829: Sanitize GetLateOrMissingIssues inputs Signed-off-by: Magnus Enger <magnus@libriotech.no> The new test fails without this patch, and passes when it is applied. Second patch changed author? Created attachment 176312 [details] [review] Bug 38829: Add a test Signed-off-by: Magnus Enger <magnus@libriotech.no> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> [EDIT] Added a shebang line. Created attachment 176313 [details] [review] Bug 38829: Sanitize GetLateOrMissingIssues inputs Signed-off-by: Magnus Enger <magnus@libriotech.no> The new test fails without this patch, and passes when it is applied. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> (In reply to Marcel de Rooy from comment #8) > Second patch changed author? Will restore on Monday. Created attachment 176426 [details] [review] Bug 38829: Sanitize GetLateOrMissingIssues inputs Signed-off-by: Magnus Enger <magnus@libriotech.no> The new test fails without this patch, and passes when it is applied. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Dears, The CVE number is: CVE-2025-22954 Kind regards. This is scheduled to be in the next maintenance releases. Applied to 24.05.x-security Applied to 23.11.x-security Applied to 22.11.x-security branch for next release. Applied to 24.11.x-security Please rebase for 22.11.x (In reply to Jesse Maseto from comment #17) > Applied to 22.11.x-security branch for next release. (In reply to Jesse Maseto from comment #19) > Please rebase for 22.11.x ? (In reply to Katrin Fischer from comment #20) > (In reply to Jesse Maseto from comment #17) > > Applied to 22.11.x-security branch for next release. > > (In reply to Jesse Maseto from comment #19) > > Please rebase for 22.11.x > > ? It's already in 22.11-security -> ec77a84c1ce8ca58214587291d16387b2ffce109 Pushed for 25.05! Well done everyone, thank you! |