CVE-2016-6606

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2016-6606

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6606.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2016-6606

Related

Published

2016-12-11T02:59:10Z

Modified

2024-09-18T02:54:19.112612Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Furthermore, the same initialization vector (IV) is used to hash the username and password stored in the phpMyAdmin cookie. If a user has the same password as their username, an attacker who examines the browser cookie can see that they are the same - but the attacker can not directly decode these values from the cookie as it is still hashed. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

References

Affected packages

Alpine:v3.2 / phpmyadmin

Package

Name: phpmyadmin
Purl: pkg:apk/alpine/phpmyadmin?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.4.15.8-r0

Affected versions

3.*

3.3.10-r0

3.3.10-r1

3.3.10-r2

3.4.9-r0

3.4.11.1-r0

4.*

4.0.0-r0

4.0.1-r0

4.0.2-r0

4.0.3-r0

4.0.4.1-r0

4.0.4.2-r0

4.0.5-r0

4.0.6-r0

4.0.7-r0

4.0.8-r0

4.0.8-r1

4.0.8-r2

4.0.9-r0

4.0.10-r0

4.1.4-r0

4.1.5-r0

4.1.6-r0

4.1.7-r0

4.1.8-r0

4.1.9-r0

4.1.11-r0

4.1.12-r0

4.1.13-r0

4.1.14-r0

4.2.0-r0

4.2.1-r0

4.2.2-r0

4.2.3-r0

4.2.4-r0

4.2.5-r0

4.2.6-r0

4.2.7-r0

4.2.7.1-r0

4.2.8-r0

4.2.8.1-r0

4.2.9-r0

4.2.9.1-r0

4.2.10-r0

4.2.10.1-r0

4.2.11-r0

4.2.12-r0

4.2.13.1-r0

4.3.0-r0

4.3.1-r0

4.3.3-r0

4.3.4-r0

4.3.5-r0

4.3.7-r0

4.3.8-r0

4.3.9-r0

4.3.10-r0

4.3.11.1-r0

4.3.12-r0

4.3.13-r0

4.4.1.1-r0

4.4.3-r0

4.4.4-r0

4.4.5-r0

4.4.7-r0

4.4.15-r0

4.4.15.1-r0

4.4.15.4-r0

4.4.15.7-r0

Debian:11 / phpmyadmin

Package

Name: phpmyadmin
Purl: pkg:deb/debian/phpmyadmin?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4:4.6.4+dfsg1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / phpmyadmin

Package

Name: phpmyadmin
Purl: pkg:deb/debian/phpmyadmin?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4:4.6.4+dfsg1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / phpmyadmin

Package

Name: phpmyadmin
Purl: pkg:deb/debian/phpmyadmin?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4:4.6.4+dfsg1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/phpmyadmin/phpmyadmin

Affected ranges

Type: GIT
Repo: https://github.com/phpmyadmin/phpmyadmin
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

00828f9ccb1024fbcd528f41dfdf28fab918dfff

Last affected

07fd0bce678e83d5f81d7a683f1052fe45764d0c

Last affected

13a288d0da6e79b99acb9052bcf31b6650c624b5

Last affected

16136ea0ef224ed22c3dffd629e3e147579f5f38

Last affected

1c1753bb6666381fa2cd2cd1f160286935244a35

Last affected

1f1e63cd5956eca847891b28b24e90ceaeaeb009

Last affected

1fe735d098d82ad79500eab04c4d25ba8fe25a24

Last affected

2189c875356fc1af21c6da32235bf24f60f53b96

Last affected

21eda1c2c42d28370b91c99017dcee7eef9691fd

Last affected

243ed0268fa15567c8a787eeb6055a232102b91a

Last affected

2694c36ef6e86de019196698a9de1953645fba97

Last affected

2fecc279f5d51e00a203cd400ace24b6053969a4

Last affected

32f512698518214fcc59ea45e0f35b0aedff16cb

Last affected

35e191d74b50c8f5a7b87fa9889869cc3a88255d

Last affected

37b38431d167915675fc8ab512470528147e72de

Last affected

3c96596f7d897e048be4c2c85d941aadd6141ba9

Last affected

3df57a818917737d65e0e1c7cce80e9eb69e5e0b

Last affected

3fc737460caa3c47d9d51751d712cc8784b1dfef

Last affected

409c9bc50aa447c52d334c839f4aa239f66c5e03

Last affected

426c5d9c1ded024c9306428ce165ae82d6f6d5df

Last affected

5004dc40980b8dfe04c328abed85fde991833624

Last affected

5118938f103e0022329847b654fcd99c8cb37de7

Last affected

52b6cfde9f581ee6818db0e3f5d80db8c29dfa34

Last affected

5b0543da6915bac44cb15e7e73f9e1886fe57588

Last affected

5b2b959a40ddd728d5ef4c6b09f118038c5e8af0

Last affected

5e5261284190c6fe6985547fbd19d3345df14be1

Last affected

64c2b9a59c09e4a04be2238553c3fcfbc58b7949

Last affected

66149607b1b578bbedc0a90e3c000e8c410c7c8e

Last affected

66aba31923f26124e06b2a55b837e4fd47c5ef1d

Last affected

6ab95d9bec50f6be6b5439abed35f99ab3fa5cbc

Last affected

6da64cc3b2ba4439574f914f51e161645375be96

Last affected

78a6214afcee3a6b65eb5e1ac261aa8e70f36736

Last affected

82161a6c30a9ac2502d822e29cfb66beae7eeb4c

Last affected

83416df64f2277d8853fcdd048df7bb154514d03

Last affected

86a7d2704994c43a4fae11cf38105fc3cb3d4d5b

Last affected

95104ff56e15876c6b481e09c9f0169e34b781f8

Last affected

a1b4ecc69bc4ac90a54e3f3c8644ca18f13b010d

Last affected

a395665715a3f56db9692486d120fb1dc00bcc5d

Last affected

a62fcf03af4c7f9df2393fbe58ae8653166763fa

Last affected

ad54449d105365dbbd39ae879306f1037fe238cd

Last affected

b0d60e271a6f47d2e0ecd81ad620b5d185acc0b1

Last affected

b1cc43ee7f8607c80889570912c5a54b7409b4d1

Last affected

b478a3d5c4fc1341a0a77235d2afbd2b4e4d0a6c

Last affected

b7c2e99987c2c52c6e8010b55b75f3c1c039216a

Last affected

b8f86592e900310f0b39d8e5270b26bebd0cfad8

Last affected

c21937440af0b0b2ed752f229c3d2523ac178d85

Last affected

c68478ad7d0523e42aa789ba24ea5f9018510047

Last affected

ceb7d7e1b2f8ab1e61710d0d061f10193a6c44c5

Last affected

d0f7dc79905f4795d328a018772871f9f98957fc

Last affected

d81165f34555c5202d8150ae1d080834dd601d5b

Last affected

d8f4a2d661f78281db7ee6826651ffc9574a2b31

Last affected

daf86cd1e369f63ad132d8dc63a7217267030408

Last affected

dba2af651a53d5037296a1dc827081a94ef1062c

Last affected

e0c1ed02a11b4ed46d82a31b7f95030854865add

Last affected

e4db51c0d47ac6e319ba93ce0d5706a33f736c00

Last affected

f1668937772688de3bbd707cee23ef8653756f32

Last affected

f2db92434b71973a1281dfbaec8837e51e602c77

Last affected

f7f483e99a74648843cc87265033442aeb4b7342

Last affected

f86761326c97eb5e2c9cefa2b1871252357f00a0

Last affected

fecf8b76ef831be0a5a8fddb1c3edf4251e92076

Affected versions

Other

RELEASE_2_10_0

RELEASE_2_10_0RC1

RELEASE_2_10_0_1

RELEASE_2_10_0_2

RELEASE_2_10_1RC1

RELEASE_2_10_2

RELEASE_2_10_3

RELEASE_2_10_3RC1

RELEASE_2_11_0

RELEASE_2_11_0BETA1

RELEASE_2_11_0RC1

RELEASE_2_11_0RC2

RELEASE_2_11_1

RELEASE_2_11_10

RELEASE_2_11_10_1

RELEASE_2_11_11

RELEASE_2_11_11RC1

RELEASE_2_11_11_1

RELEASE_2_11_11_2

RELEASE_2_11_11_3

RELEASE_2_11_1RC1

RELEASE_2_11_1_1

RELEASE_2_11_1_2

RELEASE_2_11_2

RELEASE_2_11_2RC1

RELEASE_2_11_2_1

RELEASE_2_11_2_2

RELEASE_2_11_3

RELEASE_2_11_3RC1

RELEASE_2_11_4

RELEASE_2_11_4RC1

RELEASE_2_11_5

RELEASE_2_11_5RC1

RELEASE_2_11_5_1

RELEASE_2_11_5_2

RELEASE_2_11_6

RELEASE_2_11_6RC1

RELEASE_2_11_7

RELEASE_2_11_7RC1

RELEASE_2_11_7RC2

RELEASE_2_11_7_1

RELEASE_2_11_8

RELEASE_2_11_8RC1

RELEASE_2_11_8_1

RELEASE_2_11_9

RELEASE_2_11_9_1

RELEASE_2_11_9_2

RELEASE_2_11_9_3

RELEASE_2_11_9_4

RELEASE_2_11_9_5

RELEASE_2_11_9_6

RELEASE_2_2_0

RELEASE_2_2_1

RELEASE_2_2_2

RELEASE_2_2_3

RELEASE_2_2_4

RELEASE_2_2_5

RELEASE_2_2_6

RELEASE_2_2_7PL1

RELEASE_2_3_0

RELEASE_2_3_1

RELEASE_2_3_2

RELEASE_2_3_3PL1

RELEASE_2_4_0

RELEASE_2_5_0

RELEASE_2_5_1

RELEASE_2_5_2

RELEASE_2_5_4

RELEASE_2_5_5PL1

RELEASE_2_5_6

RELEASE_2_5_7PL1

RELEASE_2_6_1PL3

RELEASE_2_6_2PL1

RELEASE_2_6_3PL1

RELEASE_2_6_4PL4

RELEASE_2_7_0PL2

RELEASE_2_8_0_4

RELEASE_2_8_1

RELEASE_2_8_2_4

RELEASE_2_9_0

RELEASE_2_9_0_1

RELEASE_2_9_0_2

RELEASE_2_9_1_1

RELEASE_2_9_2

RELEASE_2_9_2RC1

RELEASE_3_0_0

RELEASE_3_0_0ALPHA

RELEASE_3_0_0BETA

RELEASE_3_0_0RC1

RELEASE_3_0_0RC2

RELEASE_3_0_1

RELEASE_3_0_1RC1

RELEASE_3_0_1_1

RELEASE_3_1_0

RELEASE_3_1_0BETA1

RELEASE_3_1_0RC1

RELEASE_3_1_1

RELEASE_3_1_2

RELEASE_3_1_2RC1

RELEASE_3_1_3

RELEASE_3_1_3RC1

RELEASE_3_1_3_1

RELEASE_3_1_3_2

RELEASE_3_1_4

RELEASE_3_1_4RC1

RELEASE_3_1_4RC2

RELEASE_3_1_5

RELEASE_3_1_5RC1

RELEASE_3_2_0

RELEASE_3_2_0BETA1

RELEASE_3_2_0RC1

RELEASE_3_2_0_1

RELEASE_3_2_2

RELEASE_3_2_2RC1

RELEASE_3_2_2_1

RELEASE_3_2_3

RELEASE_3_2_3RC1

RELEASE_3_2_4

RELEASE_3_2_4RC1

RELEASE_3_2_5

RELEASE_3_2_5RC1

RELEASE_3_2_5RC2

RELEASE_3_3_0

RELEASE_3_3_0ALPHA1

RELEASE_3_3_0BETA1

RELEASE_3_3_0RC1

RELEASE_3_3_0RC2

RELEASE_3_3_0RC3

RELEASE_3_3_1

RELEASE_3_3_10

RELEASE_3_3_10RC1

RELEASE_3_3_10_1

RELEASE_3_3_10_2

RELEASE_3_3_10_3

RELEASE_3_3_10_4

RELEASE_3_3_10_5

RELEASE_3_3_1RC1

RELEASE_3_3_2

RELEASE_3_3_2RC1

RELEASE_3_3_3

RELEASE_3_3_3RC1

RELEASE_3_3_4

RELEASE_3_3_4RC1

RELEASE_3_3_5

RELEASE_3_3_5RC1

RELEASE_3_3_5_1

RELEASE_3_3_6

RELEASE_3_3_6RC1

RELEASE_3_3_7

RELEASE_3_3_7RC1

RELEASE_3_3_8

RELEASE_3_3_8RC1

RELEASE_3_3_8_1

RELEASE_3_3_9

RELEASE_3_3_9RC1

RELEASE_3_3_9_1

RELEASE_3_3_9_2

RELEASE_3_4_0

RELEASE_3_4_0ALPHA1

RELEASE_3_4_0ALPHA2

RELEASE_3_4_0BETA1

RELEASE_3_4_0BETA2

RELEASE_3_4_0BETA3

RELEASE_3_4_0BETA4

RELEASE_3_4_0RC1

RELEASE_3_4_0RC2

RELEASE_3_4_1

RELEASE_3_4_10

RELEASE_3_4_10RC1

RELEASE_3_4_10_1

RELEASE_3_4_11

RELEASE_3_4_11RC1

RELEASE_3_4_11_1

RELEASE_3_4_1RC1

RELEASE_3_4_2

RELEASE_3_4_2RC1

RELEASE_3_4_3

RELEASE_3_4_3RC1

RELEASE_3_4_3_1

RELEASE_3_4_3_2

RELEASE_3_4_4

RELEASE_3_4_4RC1

RELEASE_3_4_5

RELEASE_3_4_5RC1

RELEASE_3_4_6

RELEASE_3_4_6RC1

RELEASE_3_4_7

RELEASE_3_4_7RC1

RELEASE_3_4_7_1

RELEASE_3_4_8

RELEASE_3_4_8RC1

RELEASE_3_4_9

RELEASE_3_4_9RC1

RELEASE_3_5_0

RELEASE_3_5_0ALPHA1

RELEASE_3_5_0BETA1

RELEASE_3_5_0RC1

RELEASE_3_5_0RC2

RELEASE_3_5_1

RELEASE_3_5_1RC1

RELEASE_3_5_2

RELEASE_3_5_2RC1

RELEASE_3_5_2_1

RELEASE_3_5_2_2

RELEASE_3_5_3

RELEASE_3_5_3RC1

RELEASE_3_5_4

RELEASE_3_5_4RC1

RELEASE_3_5_5RC1

RELEASE_3_5_6

RELEASE_3_5_6RC1

RELEASE_3_5_7

RELEASE_3_5_7RC1

RELEASE_3_5_8

RELEASE_3_5_8RC1

RELEASE_3_5_8_1

RELEASE_4_0_0

RELEASE_4_0_0ALPHA1

RELEASE_4_0_0ALPHA2

RELEASE_4_0_0BETA1

RELEASE_4_0_0BETA2

RELEASE_4_0_0BETA3

RELEASE_4_0_0RC1

RELEASE_4_0_0RC2

RELEASE_4_0_0RC3

RELEASE_4_0_0RC4

RELEASE_4_0_10

RELEASE_4_0_10_1

RELEASE_4_0_10_2

RELEASE_4_0_10_3

RELEASE_4_0_10_4

RELEASE_4_0_10_5

RELEASE_4_0_10_6

RELEASE_4_0_10_7

RELEASE_4_0_1RC1

RELEASE_4_0_2

RELEASE_4_0_2RC1

RELEASE_4_0_3

RELEASE_4_0_3RC1

RELEASE_4_0_4

RELEASE_4_0_4RC1

RELEASE_4_0_4_1

RELEASE_4_0_4_2

RELEASE_4_0_5RC1

RELEASE_4_0_6

RELEASE_4_0_6RC1

RELEASE_4_0_6RC2

RELEASE_4_1_0ALPHA1

RELEASE_4_1_0ALPHA2

RELEASE_4_1_0BETA1

RELEASE_4_1_0BETA2

RELEASE_4_1_0RC1

RELEASE_4_1_0RC2

RELEASE_4_1_0RC3

RELEASE_4_2_0

RELEASE_4_2_0ALPHA1

RELEASE_4_2_0ALPHA2

RELEASE_4_2_0BETA1

RELEASE_4_2_0RC1

RELEASE_4_2_10

RELEASE_4_2_10_1

RELEASE_4_2_11

RELEASE_4_2_12

RELEASE_4_2_13

RELEASE_4_2_13_1

RELEASE_4_2_7

RELEASE_4_2_7_1

RELEASE_4_2_8

RELEASE_4_2_8_1

RELEASE_4_2_9

RELEASE_4_2_9_1

RELEASE_4_3_0

RELEASE_4_3_0ALPHA1

RELEASE_4_3_0BETA1

RELEASE_4_3_0RC1

RELEASE_4_3_0RC2

RELEASE_4_3_1

RELEASE_4_3_10

RELEASE_4_3_11

RELEASE_4_3_11_1

RELEASE_4_3_12

RELEASE_4_3_13

RELEASE_4_3_2

RELEASE_4_3_3

RELEASE_4_3_4

RELEASE_4_3_5

RELEASE_4_3_6

RELEASE_4_3_7

RELEASE_4_3_8

RELEASE_4_3_9

RELEASE_4_4_0

RELEASE_4_4_0ALPHA1

RELEASE_4_4_1

RELEASE_4_4_10

RELEASE_4_4_11

RELEASE_4_4_12

RELEASE_4_4_13

RELEASE_4_4_13_1

RELEASE_4_4_14

RELEASE_4_4_14_1

RELEASE_4_4_15

RELEASE_4_4_15_1

RELEASE_4_4_15_2

RELEASE_4_4_1_1

RELEASE_4_4_2

RELEASE_4_4_3

RELEASE_4_4_4

RELEASE_4_4_5

RELEASE_4_4_6

RELEASE_4_4_6_1

RELEASE_4_4_7

RELEASE_4_4_8

RELEASE_4_4_9

RELEASE_4_5_0

RELEASE_4_5_0RC1

RELEASE_4_5_0_1

RELEASE_4_5_0_2

RELEASE_4_5_1

RELEASE_4_5_2

RELEASE_4_5_3

RELEASE_4_5_3_1

RELEASE_4_5_4

RELEASE_4_5_4_1

RELEASE_4_5_5

RELEASE_4_5_5_1

RELEASE_4_6_0

RELEASE_4_6_0ALPHA1

RELEASE_4_6_0RC1

RELEASE_4_6_0RC2

RELEASE_4_6_1