~ / search / GHSA-vwp5-w4rq-g4cc

GHSA-vwp5-w4rq-g4cc

Koji blacklisted paths workaround

Source: GitHub Advisory Database (reviewed) High CVE-2017-1002153

Packages

EcosystemPackageAffectedFixed in
PyPI koji < 1.15.0 1.15.0

Details

As written in the advisory (Markdown source, shown as plain text).

Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.

References

External links from the advisory. They lead to third-party sites.