PT-2017-11022 · Red Hat · Koji

Puiterwijk · Publicado 2017-10-06 · Atualizado 2023-03-01 · CVE-2017-1002153

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Koji version 1.13.0

Description The issue arises from improper validation of SCM paths, enabling an attacker to bypass blacklisted paths for build submission.

Recommendations For version 1.13.0, update to a newer version that properly validates SCM paths to prevent exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-1002153

GHSA-VWP5-W4RQ-G4CC

PYSEC-2017-144

Produtos afetados

Koji

Referências · 11

• https://github.com/pypa/advisory-database/tree/main/vulns/koji/PYSEC-2017-144.yaml · Nota
• https://github.com/koji-project/koji · Nota
• https://pagure.io/koji/issue/563 · Correção
• https://osv.dev/vulnerability/GHSA-vwp5-w4rq-g4cc · Aviso do Fabricante
• https://github.com/advisories/GHSA-vwp5-w4rq-g4cc · Nota
• https://osv.dev/vulnerability/CVE-2017-1002153 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-1002153 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2017-144 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-1002153 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-1002153 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-1002153 · Aviso do Fabricante