From: Damien Regad Date: Mon, 10 Jan 2022 09:41:32 +0100 Subject: Prevent auth bypass with PostgreSQL connections Origin: https://github.com/ADOdb/ADOdb/commit/952de6c4273d9b1e91c2b838044f8c2111150c29 Bug: https://github.com/ADOdb/ADOdb/issues/793 Bug-Debian: https://bugs.debian.org/1004376 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2021-3850 Thanks to Emmet Leahy of Sorcery Ltd for reporting this vulnerability (CVE-2021-3850). This is a minimalistic approach to patch the issue, to reduce the risk of causing regressions in the legacy stable branch. Fixes #793 --- drivers/adodb-postgres64.inc.php | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/adodb-postgres64.inc.php b/drivers/adodb-postgres64.inc.php index 27e06b06977c..c98ade9aeac4 100644 --- a/drivers/adodb-postgres64.inc.php +++ b/drivers/adodb-postgres64.inc.php @@ -51,7 +51,6 @@ function adodb_addslashes($s) { $len = strlen($s); if ($len == 0) return "''"; - if (strncmp($s,"'",1) === 0 && substr($s,$len-1) == "'") return $s; // already quoted return "'".addslashes($s)."'"; } -- 2.35.1