USN-4693-1

It was discovered that an SQL injection vulnerability exists in the Ampache search engine. Any user able to perform searches could dump any data contained in the database. An attacker could use this to disclose sensitive information. (CVE-2019-12385)

It was discovered that an XSS vulnerability in Ampache. An attacker could use this vulnerability to force an admin to create a new privileged user. (CVE-2019-12386)

References

Affected packages

Ubuntu:16.04:LTS / ampache

Package

Name: ampache
Purl: pkg:deb/ubuntu/ampache@3.6-rzb2779+dfsg-0ubuntu9.2?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.6-rzb2779+dfsg-0ubuntu9.2

Affected versions

3.*

3.6-rzb2779+dfsg-0ubuntu5

3.6-rzb2779+dfsg-0ubuntu6

3.6-rzb2779+dfsg-0ubuntu7

3.6-rzb2779+dfsg-0ubuntu8

3.6-rzb2779+dfsg-0ubuntu9

3.6-rzb2779+dfsg-0ubuntu9.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ampache",
            "binary_version": "3.6-rzb2779+dfsg-0ubuntu9.2"
        },
        {
            "binary_name": "ampache-common",
            "binary_version": "3.6-rzb2779+dfsg-0ubuntu9.2"
        }
    ],
    "availability": "No subscription required"
}

Database specific

cves_map

{
    "cves": [
        {
            "id": "CVE-2019-12385",
            "severity": [
                {
                    "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2019-12386",
            "severity": [
                {
                    "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:16.04:LTS"
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-4693-1.json"