bug #4900 [security] Vulnerability allowing man-in-the-middle attack

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
phpmyadmin · May 13, 2015 · 0e18931 · 0e18931
1 parent c903ecf
commit 0e18931
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 2 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog
 
 4.2.13.3 (Not yet released)
 - bug #4899 [security] CSRF vulnerability in setup
+- bug #4900 [security] Vulnerability allowing man-in-the-middle attack
 
 4.2.13.2 (2015-03-04)
 - bug       [security] Risk of BREACH attack, see PMASA-2015-1

diff --git a/libraries/Config.class.php b/libraries/Config.class.php
@@ -748,8 +748,6 @@ function checkHTTP($link, $get_body = false)
         curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
         curl_setopt($ch, CURLOPT_HEADER, 1);
         curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
-        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
-        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
         curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
         curl_setopt($ch, CURLOPT_USERAGENT, 'phpMyAdmin/' . PMA_VERSION);
         curl_setopt($ch, CURLOPT_TIMEOUT, 5);