[USN-4693-1] Ampache vulnerabilities

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

[USN-4693-1] Ampache vulnerabilities

Paulo Flabiano Smorigo
==========================================================================
Ubuntu Security Notice USN-4693-1
January 14, 2021

ampache vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Ampache.

Software Description:
- ampache: web-based audio file management system

Details:

It was discovered that an SQL injection vulnerability exists in the Ampache
search engine. Any user able to perform searches could dump any data contained
in the database. An attacker could use this to disclose sensitive information.
(CVE-2019-12385)

It was discovered that an XSS vulnerability in Ampache. An attacker could use
this vulnerability to force an admin to create a new privileged user.
(CVE-2019-12386)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  ampache                         3.6-rzb2779+dfsg-0ubuntu9.2
  ampache-common                  3.6-rzb2779+dfsg-0ubuntu9.2

After a standard system update you need to restart ampache to make
all the necessary changes.

References:
  https://usn.ubuntu.com/4693-1
  CVE-2019-12385, CVE-2019-12386

Package Information:
  https://launchpad.net/ubuntu/+source/ampache/3.6-rzb2779+dfsg-0ubuntu9.2

--
ubuntu-security-announce mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

signature.asc (849 bytes) Download Attachment