Comment # 4 on bug 994313 from Marcus Meissner

https://www.phpmyadmin.net/security/PMASA-2016-53/



Announcement-ID: PMASA-2016-53

Date: 2016-07-25
Summary

Denial of service (DOS) attack by changing password to a very long string
Description

An authenticated user can trigger a denial-of-service (DOS) attack by entering
a very long password at the change password dialog.
Severity

We consider this vulnerability to be serious.
Affected Versions

All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and
4.0.x versions (prior to 4.0.10.17) are affected
Solution

Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, 4.0.10.17, or newer or apply patch
listed below.
References

Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability.

Assigned CVE ids: CVE-2016-6630

CWE ids: CWE-661
Patches

The following commits have been made on the 4.0 branch to fix this issue:

    b0e6671