CVE-2017-1002153 Koji blacklisted paths workaround
HighCVSS 7.5
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi koji(PyPI) | < 1.15.0 | 1.15.0 |
| pypi koji(PyPI) | All versions | No fix listed |
| pypi koji(PyPI) | = 1.15.0 | No fix listed |
| pypi koji(PyPI) | = 1.16.0 | No fix listed |
| pypi koji(PyPI) | = 1.16.1 | No fix listed |
| pypi koji(PyPI) | = 1.17.0 | No fix listed |
| pypi koji(PyPI) | = 1.18.0 | No fix listed |
| pypi koji(PyPI) | = 1.19.0 | No fix listed |
| pypi koji(PyPI) | = 1.19.1 | No fix listed |
| pypi koji(PyPI) | = 1.20.0 | No fix listed |
| pypi koji(PyPI) | = 1.20.1 | No fix listed |
| pypi koji(PyPI) | = 1.21.0 | No fix listed |
| pypi koji(PyPI) | = 1.21.1 | No fix listed |
| pypi koji(PyPI) | = 1.22.0 | No fix listed |
| pypi koji(PyPI) | = 1.22.1 | No fix listed |
| pypi koji(PyPI) | = 1.23.0 | No fix listed |
| pypi koji(PyPI) | = 1.23.1 | No fix listed |
| pypi koji(PyPI) | = 1.24.0 | No fix listed |
| pypi koji(PyPI) | = 1.24.1 | No fix listed |
| pypi koji(PyPI) | = 1.25.0 | No fix listed |
| pypi koji(PyPI) | = 1.25.1 | No fix listed |
| pypi koji(PyPI) | = 1.26.0 | No fix listed |
| pypi koji(PyPI) | = 1.26.1 | No fix listed |
| pypi koji(PyPI) | = 1.27.0 | No fix listed |
| pypi koji(PyPI) | = 1.27.1 | No fix listed |
Show 23 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi koji(PyPI) | = 1.28.0 | No fix listed |
| pypi koji(PyPI) | = 1.28.1 | No fix listed |
| pypi koji(PyPI) | = 1.29.0 | No fix listed |
| pypi koji(PyPI) | = 1.29.1 | No fix listed |
| pypi koji(PyPI) | = 1.30.0 | No fix listed |
| pypi koji(PyPI) | = 1.30.1 | No fix listed |
| pypi koji(PyPI) | = 1.31.0 | No fix listed |
| pypi koji(PyPI) | = 1.31.1 | No fix listed |
| pypi koji(PyPI) | = 1.32.0 | No fix listed |
| pypi koji(PyPI) | = 1.32.1 | No fix listed |
| pypi koji(PyPI) | = 1.33.0 | No fix listed |
| pypi koji(PyPI) | = 1.33.1 | No fix listed |
| pypi koji(PyPI) | = 1.33.2 | No fix listed |
| pypi koji(PyPI) | = 1.34.0 | No fix listed |
| pypi koji(PyPI) | = 1.34.1 | No fix listed |
| pypi koji(PyPI) | = 1.34.2 | No fix listed |
| pypi koji(PyPI) | = 1.34.3 | No fix listed |
| pypi koji(PyPI) | = 1.35.0 | No fix listed |
| pypi koji(PyPI) | = 1.35.1 | No fix listed |
| pypi koji(PyPI) | = 1.35.2 | No fix listed |
| pypi koji(PyPI) | = 1.35.3 | No fix listed |
| pypi koji(PyPI) | = 1.36.0 | No fix listed |
| koji project koji | = 1.13.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- github.com
- pagure.io issue-tracking patch
- github.com vendor-advisory