[GHSA-r4ph-mx67-x58p] Shopware database password is leaked to an unauthenticated users

[mitelg]

Updates

• Affected products

Comments The composer package name shopware/shopware refers to Shopware 5 and is a totally different system. See https://github.com/shopware5/shopware/blob/5.7/composer.json#L2 We just renamed the GitHub repository name from shopware/platform to shopware/shopware a while ago.

This urgently needs to be fixed, as it spreads misinformation about a wrong security issue on a project that is not affected

[CallmeMari]

Hi @mitelg, we appreciate this information. Just to confirm, what should the package name be updated to?

[mitelg]

hey @CallmeMari the affected packages are still in there. platform and core

[mitelg]

@CallmeMari any news on this? unfortunately the misinformation already spread a lot...

[advisory-database[bot]]

Hi @mitelg! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

[darakian]

Hey @mitelg, I'm so sorry this didn't get handled in a timely manner. I've pulled shopware/shopware as an affected product and added an explicit note to the advisory about shopware 5. I think I've found the correct fix commit as well in https://github.com/shopware/core/commit/3c759bbeeda8b59d6f3792f75a0ac28cffeef8c6 Does that look right to you?

[mitelg]

hey @darakian

thanks for merging and adding the note. I see on packagist, that the latest Shopware 5 releases are not longer marked as affected by this :+1:

Yes, that should be the fix, addressing this issue

[darakian]

I see on packagist, that the latest Shopware 5 releases are not longer marked as affected by this 👍

👀

Do you know if packagist is pulling from our database for those markings? News to me if so.

[mitelg]

that's how I came to this repository in the first place 😁 I visited the page for Shopware 5 and was wondering why the latest version was marked with security advisories, although it has no known security issues

[darakian]

TIL. I had no idea they were ingesting from us. Neat!