Description
Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | koji | No fix yet | — |
| Ubuntu 16.04 LTS | koji | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | koji | >= 1.14.0, < 1.14.3 | 1.14.3 | GHSA-7498-c9fm-g64p |
| PyPI | koji | >= 1.15.0, < 1.15.3 | 1.15.3 | GHSA-7498-c9fm-g64p |
| PyPI | koji | >= 1.16.0, < 1.16.3 | 1.16.3 | GHSA-7498-c9fm-g64p |
| PyPI | koji | >= 1.17.0, < 1.17.1 | 1.17.1 | GHSA-7498-c9fm-g64p |
| PyPI | koji | >= 1.18.0, < 1.18.1 | 1.18.1 | GHSA-7498-c9fm-g64p |
| PyPI | koji | < 1.19.0 | 1.19.0 | PYSEC-2019-183 |
References
- http://www.openwall.com/lists/oss-security/2019/10/09/5
- https://docs.pagure.org/koji/CVE-2019-17109/
- https://pagure.io/koji/commits/master
- FEDORA-2019-adf618865f vendor-advisory
- FEDORA-2019-caff41caf8 vendor-advisory
- FEDORA-2019-bf8b97d604 vendor-advisory