[Secure-testing-team] Bug#882543: tt-rss: CVE-2017-16896: SQL injection in classes/handler/public.php in the forgotpass component via login parameter

Thu Nov 23 20:27:22 UTC 2017

Source: tt-rss
Version: 17.1+git20170410+dfsg-2
Severity: important
Tags: patch security upstream

Hi,

the following vulnerability was published for tt-rss.

CVE-2017-16896[0]:
| A SQL injection in classes/handler/public.php in the forgotpass
| component of Tiny Tiny RSS 17.4 exists via the login parameter.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-16896
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16896
[1] https://discourse.tt-rss.org/t/sql-injection-in-forgotpass-fixed/669
[2] https://git.tt-rss.org/git/tt-rss/commit/2352c320c2ed34ec7df1ad22f0c55a1b26489815

Regards,
Salvatore