CVE-2016-2562

The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate.

References

Affected packages

Git / github.com/phpmyadmin/phpmyadmin

Affected ranges

Type

GIT

Repo

https://github.com/phpmyadmin/phpmyadmin

Events

Introduced

Last affected

796e6ae09301a7ea8aae74fdb3bb44538c0f5151

Introduced

Last affected

7ab576930ba6cd844c3bbffa6161b8b4669b969c

Introduced

Last affected

9e08133f49f0b99868fec434762366d08a45b6f8

Introduced

Last affected

ae7d3bb97a30805f98945fd4a442d023ae0ea24a

Introduced

Last affected

b900c917101a15c78666579a28bab19b95bef669

Introduced

Last affected

1ec51857f828c2d409ad76450695ca281ed89fc3

Introduced

Last affected

a81ac373c82ec81351b3e5a30c5aa0b2b9e444af

Introduced

Last affected

d89a6bda4c6de1bac301f737e290ae376c15be56

Introduced

Last affected

2870a797f366589d89bc23c6cf29681f17ce3a89

Introduced

Last affected

1cb223f320dbf29fd4ae00a21f5d6bb2e3f43524

Introduced

Last affected

4b3c91b0f5c19afec21a909f80bd4fd0e0a056dc

Fixed

e42b7e3aedd29dd0f7a48575f20bfc5aca0ff976

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.5.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.5.0-rc1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.5.0.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.5.0.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.5.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.5.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.5.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.5.3.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.5.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.5.4.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.5.5"
        }
    ]
}

Affected versions

Other

RELEASE_2_10_0

RELEASE_2_10_0RC1

RELEASE_2_10_0_1

RELEASE_2_10_0_2

RELEASE_2_10_1RC1

RELEASE_2_10_2

RELEASE_2_10_3

RELEASE_2_10_3RC1

RELEASE_2_11_0

RELEASE_2_11_0BETA1

RELEASE_2_11_0RC1

RELEASE_2_11_0RC2

RELEASE_2_11_1

RELEASE_2_11_10

RELEASE_2_11_10_1

RELEASE_2_11_11

RELEASE_2_11_11RC1

RELEASE_2_11_11_1

RELEASE_2_11_11_2

RELEASE_2_11_11_3

RELEASE_2_11_1RC1

RELEASE_2_11_1_1

RELEASE_2_11_1_2

RELEASE_2_11_2

RELEASE_2_11_2RC1

RELEASE_2_11_2_1

RELEASE_2_11_2_2

RELEASE_2_11_3

RELEASE_2_11_3RC1

RELEASE_2_11_4

RELEASE_2_11_4RC1

RELEASE_2_11_5

RELEASE_2_11_5RC1

RELEASE_2_11_5_1

RELEASE_2_11_5_2

RELEASE_2_11_6

RELEASE_2_11_6RC1

RELEASE_2_11_7

RELEASE_2_11_7RC1

RELEASE_2_11_7RC2

RELEASE_2_11_7_1

RELEASE_2_11_8

RELEASE_2_11_8RC1

RELEASE_2_11_8_1

RELEASE_2_11_9

RELEASE_2_11_9_1

RELEASE_2_11_9_2

RELEASE_2_11_9_3

RELEASE_2_11_9_4

RELEASE_2_11_9_5

RELEASE_2_11_9_6

RELEASE_2_2_0

RELEASE_2_2_1

RELEASE_2_2_2

RELEASE_2_2_3

RELEASE_2_2_4

RELEASE_2_2_5

RELEASE_2_2_6

RELEASE_2_2_7PL1

RELEASE_2_3_0

RELEASE_2_3_1

RELEASE_2_3_2

RELEASE_2_3_3PL1

RELEASE_2_4_0

RELEASE_2_5_0

RELEASE_2_5_1

RELEASE_2_5_2

RELEASE_2_5_4

RELEASE_2_5_5PL1

RELEASE_2_5_6

RELEASE_2_5_7PL1

RELEASE_2_6_1PL3

RELEASE_2_6_2PL1

RELEASE_2_6_3PL1

RELEASE_2_6_4PL4

RELEASE_2_7_0PL2

RELEASE_2_8_0_4

RELEASE_2_8_1

RELEASE_2_8_2_4

RELEASE_2_9_0

RELEASE_2_9_0_1

RELEASE_2_9_0_2

RELEASE_2_9_1_1

RELEASE_2_9_2

RELEASE_2_9_2RC1

RELEASE_3_0_0

RELEASE_3_0_0ALPHA

RELEASE_3_0_0BETA

RELEASE_3_0_0RC1

RELEASE_3_0_0RC2

RELEASE_3_0_1

RELEASE_3_0_1RC1

RELEASE_3_0_1_1

RELEASE_3_1_0

RELEASE_3_1_0BETA1

RELEASE_3_1_0RC1

RELEASE_3_1_1

RELEASE_3_1_2

RELEASE_3_1_2RC1

RELEASE_3_1_3

RELEASE_3_1_3RC1

RELEASE_3_1_3_1

RELEASE_3_1_3_2

RELEASE_3_1_4

RELEASE_3_1_4RC1

RELEASE_3_1_4RC2

RELEASE_3_1_5

RELEASE_3_1_5RC1

RELEASE_3_2_0

RELEASE_3_2_0BETA1

RELEASE_3_2_0RC1

RELEASE_3_2_0_1

RELEASE_3_2_2

RELEASE_3_2_2RC1

RELEASE_3_2_2_1

RELEASE_3_2_3

RELEASE_3_2_3RC1

RELEASE_3_2_4

RELEASE_3_2_4RC1

RELEASE_3_2_5

RELEASE_3_2_5RC1

RELEASE_3_2_5RC2

RELEASE_3_3_0

RELEASE_3_3_0ALPHA1

RELEASE_3_3_0BETA1

RELEASE_3_3_0RC1

RELEASE_3_3_0RC2

RELEASE_3_3_0RC3

RELEASE_3_3_1

RELEASE_3_3_10

RELEASE_3_3_10RC1

RELEASE_3_3_10_1

RELEASE_3_3_10_2

RELEASE_3_3_10_3

RELEASE_3_3_10_4

RELEASE_3_3_10_5

RELEASE_3_3_1RC1

RELEASE_3_3_2

RELEASE_3_3_2RC1

RELEASE_3_3_3

RELEASE_3_3_3RC1

RELEASE_3_3_4

RELEASE_3_3_4RC1

RELEASE_3_3_5

RELEASE_3_3_5RC1

RELEASE_3_3_5_1

RELEASE_3_3_6

RELEASE_3_3_6RC1

RELEASE_3_3_7

RELEASE_3_3_7RC1

RELEASE_3_3_8

RELEASE_3_3_8RC1

RELEASE_3_3_8_1

RELEASE_3_3_9

RELEASE_3_3_9RC1

RELEASE_3_3_9_1

RELEASE_3_3_9_2

RELEASE_3_4_0

RELEASE_3_4_0ALPHA1

RELEASE_3_4_0ALPHA2

RELEASE_3_4_0BETA1

RELEASE_3_4_0BETA2

RELEASE_3_4_0BETA3

RELEASE_3_4_0BETA4

RELEASE_3_4_0RC1

RELEASE_3_4_0RC2

RELEASE_3_4_1

RELEASE_3_4_10

RELEASE_3_4_10RC1

RELEASE_3_4_10_1

RELEASE_3_4_11

RELEASE_3_4_11RC1

RELEASE_3_4_11_1

RELEASE_3_4_1RC1

RELEASE_3_4_2

RELEASE_3_4_2RC1

RELEASE_3_4_3

RELEASE_3_4_3RC1

RELEASE_3_4_3_1

RELEASE_3_4_3_2

RELEASE_3_4_4

RELEASE_3_4_4RC1

RELEASE_3_4_5

RELEASE_3_4_5RC1

RELEASE_3_4_6

RELEASE_3_4_6RC1

RELEASE_3_4_7

RELEASE_3_4_7RC1

RELEASE_3_4_7_1

RELEASE_3_4_8

RELEASE_3_4_8RC1

RELEASE_3_4_9

RELEASE_3_4_9RC1

RELEASE_3_5_0

RELEASE_3_5_0ALPHA1

RELEASE_3_5_0BETA1

RELEASE_3_5_0RC1

RELEASE_3_5_0RC2

RELEASE_3_5_1

RELEASE_3_5_1RC1

RELEASE_3_5_2

RELEASE_3_5_2RC1

RELEASE_3_5_2_1

RELEASE_3_5_2_2

RELEASE_3_5_3

RELEASE_3_5_3RC1

RELEASE_3_5_4

RELEASE_3_5_4RC1

RELEASE_3_5_5RC1

RELEASE_3_5_6

RELEASE_3_5_6RC1

RELEASE_3_5_7

RELEASE_3_5_7RC1

RELEASE_3_5_8

RELEASE_3_5_8RC1

RELEASE_3_5_8_1

RELEASE_4_0_0

RELEASE_4_0_0ALPHA1

RELEASE_4_0_0ALPHA2

RELEASE_4_0_0BETA1

RELEASE_4_0_0BETA2

RELEASE_4_0_0BETA3

RELEASE_4_0_0RC1

RELEASE_4_0_0RC2

RELEASE_4_0_0RC3

RELEASE_4_0_0RC4

RELEASE_4_0_1RC1

RELEASE_4_0_2

RELEASE_4_0_2RC1

RELEASE_4_0_3

RELEASE_4_0_3RC1

RELEASE_4_0_4

RELEASE_4_0_4RC1

RELEASE_4_0_4_1

RELEASE_4_0_4_2

RELEASE_4_0_5RC1

RELEASE_4_0_6

RELEASE_4_0_6RC1

RELEASE_4_0_6RC2

RELEASE_4_1_0ALPHA1

RELEASE_4_1_0ALPHA2

RELEASE_4_1_0BETA1

RELEASE_4_1_0BETA2

RELEASE_4_1_0RC1

RELEASE_4_1_0RC2

RELEASE_4_1_0RC3

RELEASE_4_2_0

RELEASE_4_2_0ALPHA1

RELEASE_4_2_0ALPHA2

RELEASE_4_2_0BETA1

RELEASE_4_2_0RC1

RELEASE_4_2_10

RELEASE_4_2_10_1

RELEASE_4_2_13

RELEASE_4_2_13_1

RELEASE_4_2_7

RELEASE_4_2_7_1

RELEASE_4_2_8

RELEASE_4_2_9

RELEASE_4_2_9_1

RELEASE_4_3_0ALPHA1

RELEASE_4_3_0BETA1

RELEASE_4_3_0RC1

RELEASE_4_3_0RC2

RELEASE_4_4_0ALPHA1

RELEASE_4_4_1

RELEASE_4_4_14

RELEASE_4_4_14_1

RELEASE_4_4_15

RELEASE_4_4_15_1

RELEASE_4_4_15_2

RELEASE_4_5_0

RELEASE_4_5_0RC1

RELEASE_4_5_0_1

RELEASE_4_5_2

RELEASE_4_5_3

RELEASE_4_5_3_1

RELEASE_4_5_4

RELEASE_4_5_4_1

RELEASE_4_5_5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2562.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "4.5.0-beta1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "4.5.0-beta2"
            }
        ]
    }
]