PT-2020-13978 · Librepo+3 · Librepo+3

Mauro Matteo Cascella + 2 · Published 2020-08-13 · Updated 2021-03-05 · CVE-2020-14352

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions librepo versions prior to 1.12.1

Description A directory traversal issue was found in librepo where it failed to sanitize paths in remote repository metadata. This could allow an attacker controlling a remote repository to copy files outside of the destination directory on the targeted system via path traversal, potentially resulting in system compromise by overwriting critical system files. The highest threat is to users who use untrusted third-party repositories.

Recommendations For versions prior to 1.12.1, update to version 1.12.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of untrusted third-party repositories until the update is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CESA-2020_3658

CESA-2020_5012

CVE-2020-14352

MGASA-2020-0429

OESA-2021-1055

OPENSUSE-SU-2020:1289-1

OPENSUSE-SU-2020:1428-1

OPENSUSE-SU-2020_1289-1

OPENSUSE-SU-2021:0277-1

OPENSUSE-SU-2021:0295-1

OPENSUSE-SU-2021_0277-1

OPENSUSE-SU-2024:10984-1

RHSA-2020:3658

RHSA-2020:3749

RHSA-2020:3756

RHSA-2020:5012

RHSA-2020_3658

RHSA-2020_5012

Affected Products

Centos

Red Hat

Suse

Librepo

References · 30

• https://osv.dev/vulnerability/openSUSE-SU-2021:0277-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-3658.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1428-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1055 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/33RX4P5R5YL4NZSFSE4NOX37X6YCXAS4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14352 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OOMDEQBRJ7SO2QWL7H23G3VV2VSCUYOY · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-5012.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33RX4P5R5YL4NZSFSE4NOX37X6YCXAS4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14352 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0429 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XDMHVY7OMIJNSPVZ2GJWHT77Z5V3YJ55 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1289-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0295-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00055.html · Vendor Advisory