mailing list archives
CVE Request -- MapServer -- SQL injections in OGC filter encoding and in WMS time support.
From: Jan Lieskovsky <jlieskov () redhat com>
Date: Tue, 19 Jul 2011 17:22:11 +0200
Hello Josh, Steve, vendors,
the following has been brought to our attention:
More from :
This ticket is to track fixes to prevent SQL injections through OGC
filter encoding (in WMS, WFS and SOS), as well as a potential SQL
injection in WMS time support.
Your system may be vulnerable if it has MapServer with OGC protocols
enabled, with layers connecting to an SQL RDBMS backend, either natively
or via OGR.
All versions of MapServer 4.x, 5.x and 6.x are potentially vulnerable.
All users are ** strongly encouraged ** to upgrade to one of the latest
releases with the fixes.
Could you allocate a CVE id for this?
Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team
- CVE Request -- MapServer -- SQL injections in OGC filter encoding and in WMS time support. Jan Lieskovsky (Jul 19)