| Summary: | [CVE-2025-22954] SQL Injection in lateissues-export.pl | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Zeyad Alshahrani <zeyadbinkhalid> |
| Component: | Serials | Assignee: | Jonathan Druart <jonathan.druart> |
| Status: | RESOLVED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
| Severity: | critical | ||
| Priority: | P5 - low | CC: | dcook, didier.gautheron, fridolin.somers, jesse, jonathan.druart, katrin.fischer, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, paul.derscheid, philippe.blouin, tomascohen, wainuiwitikapark |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Crowdfunding goal: | 0 |
| Patch complexity: | Small patch | Documentation contact: | |
| Documentation submission: | Text to go in the release notes: | ||
| Version(s) released in: |
25.05.00,24.11.02,24.05.07,23.11.12,22.11.24
|
Circulation function: | |
| Bug Depends on: | |||
| Bug Blocks: | 39915 | ||
| Attachments: |
Bug 38829: Add a test
Bug 38829: Sanitize GetLateOrMissingIssues inputs Bug 38829: Add a test Bug 38829: Sanitize GetLateOrMissingIssues inputs Bug 38829: Add a test Bug 38829: Sanitize GetLateOrMissingIssues inputs Bug 38829: Sanitize GetLateOrMissingIssues inputs |
||
|
Description
Zeyad Alshahrani
2025-01-06 10:29:09 UTC
P.S: I requested a CVE 2 days ago. Best regards. Moving to Koha Security Created attachment 176149 [details] [review] Bug 38829: Add a test Created attachment 176150 [details] [review] Bug 38829: Sanitize GetLateOrMissingIssues inputs Thanks for the quick work so far! Created attachment 176171 [details] [review] Bug 38829: Add a test Signed-off-by: Magnus Enger <magnus@libriotech.no> Created attachment 176172 [details] [review] Bug 38829: Sanitize GetLateOrMissingIssues inputs Signed-off-by: Magnus Enger <magnus@libriotech.no> The new test fails without this patch, and passes when it is applied. Second patch changed author? Created attachment 176312 [details] [review] Bug 38829: Add a test Signed-off-by: Magnus Enger <magnus@libriotech.no> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> [EDIT] Added a shebang line. Created attachment 176313 [details] [review] Bug 38829: Sanitize GetLateOrMissingIssues inputs Signed-off-by: Magnus Enger <magnus@libriotech.no> The new test fails without this patch, and passes when it is applied. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> (In reply to Marcel de Rooy from comment #8) > Second patch changed author? Will restore on Monday. Created attachment 176426 [details] [review] Bug 38829: Sanitize GetLateOrMissingIssues inputs Signed-off-by: Magnus Enger <magnus@libriotech.no> The new test fails without this patch, and passes when it is applied. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Dears, The CVE number is: CVE-2025-22954 Kind regards. This is scheduled to be in the next maintenance releases. Applied to 24.05.x-security Applied to 23.11.x-security Applied to 22.11.x-security branch for next release. Applied to 24.11.x-security Please rebase for 22.11.x (In reply to Jesse Maseto from comment #17) > Applied to 22.11.x-security branch for next release. (In reply to Jesse Maseto from comment #19) > Please rebase for 22.11.x ? (In reply to Katrin Fischer from comment #20) > (In reply to Jesse Maseto from comment #17) > > Applied to 22.11.x-security branch for next release. > > (In reply to Jesse Maseto from comment #19) > > Please rebase for 22.11.x > > ? It's already in 22.11-security -> ec77a84c1ce8ca58214587291d16387b2ffce109 Pushed for 25.05! Well done everyone, thank you! |