Description
SQL-Ledger before 2.4.4 stores a password in a query string, which might allow context-dependent attackers to obtain the password via a Referer field or browser history.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sql-ledger | 2.4.5-1 | — |
| Debian 13 | sql-ledger | 2.4.5-1 | — |
| Debian 12 | sql-ledger | 2.4.5-1 | — |
References
- sql-ledger-session-unauth-access(28671) vdb-entry
- 1579 third-party-advisory
- 20060907 Full Disclosure for SQL-Ledger vulnerability CVE-2006-4244 mailing-list