PT-2018-9620 · Red Hat · Koji

Mikem · Published 2018-04-04 · Updated 2019-10-03 · CVE-2018-1002150

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Koji versions 1.12 through 1.15

Description: The issue is related to incorrect access control, which results in arbitrary filesystem read/write access.

Recommendations: For versions 1.12, update to version 1.12.1. For version 1.13, update to version 1.13.1. For version 1.14, update to version 1.14.1. For version 1.15, update to version 1.15.1.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2018-1002150

GHSA-6MWW-XVH7-FQ4F

PYSEC-2018-86

Affected Products

Koji

References · 14

• https://ubuntu.com/security/CVE-2018-1002150 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1002150 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1002150 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1002150 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6mww-xvh7-fq4f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1002150 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2018-86 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/koji/PYSEC-2018-86.yaml · Note
• https://github.com/advisories/GHSA-6mww-xvh7-fq4f · Note
• http://openwall.com/lists/oss-security/2018/04/04/1 · Note
• https://docs.pagure.org/koji/CVE-2018-1002150 · Note
• https://pagure.io/koji/issue/850 · Note
• https://pagure.io/koji/c/ab1ade7 · Note
• https://pagure.io/koji · Note