USN-5271-1: Adminer vulnerabilities

Releases

• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM

Packages

• adminer - Web-based database administration tool

Details

It was discovered that Adminer did not escape data in the history parameter
of the default URI. A remote attacker could possibly use this issue to perform
cross-site scripting (XSS) attacks. This issue only affected Ubuntu 20.04 ESM.
(CVE-2020-35572)

Adam Crosser and Brian Sizemore discovered that Adminer incorrectly handled
redirection requests to internal servers. An unauthenticated remote attacker
could possibly use this to perform a server-side request forgery attack and
expose sensitive information. (CVE-2021-21311)

It was discovered that Adminer was incorrectly escaping data in the doc_link
function. A remote attacker could possibly use this issue to perform cross-site
scripting (XSS) attacks. This issue only affected Ubuntu 18.04 ESM and
Ubuntu 20.04 ESM. (CVE-2021-29625)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04

• adminer - 4.7.6-1ubuntu0.1~esm1
  Available with Ubuntu Pro

Ubuntu 18.04

• adminer - 4.6.2-1ubuntu0.1~esm1
  Available with Ubuntu Pro

Ubuntu 16.04

• adminer - 4.2.1-1ubuntu1+esm1
  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

• CVE-2021-21311
• CVE-2021-29625
• CVE-2020-35572