CVE-2018-1002150: Koji hub call does not perform correct access checks
Summary
CVE-2018-1002150: Koji hub call does not perform correct access checks. Affects koji across 4 version ranges.
>= 1.12, < 1.12.1
>= 1.13, < 1.13.1
>= 1.14, < 1.14.1
>= 1.15, < 1.15.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Koji is an open-source build system that facilitates the creation and management of software packages. It is widely used in the Python ecosystem. This vulnerability affects Koji versions 1.12, 1.13, 1.14, and 1.15. Koji's hub call does not properly perform access checks, leading to arbitrary filesystem read/write access. This vulnerability has a CVSS score of 9.1 (Critical).
Vulnerability Detail
The vulnerability in Koji allows an attacker to gain unauthorized access to the filesystem, potentially leading to the compromise of sensitive data or the execution of arbitrary code. By exploiting this vulnerability, an attacker can read or modify files on the system, bypassing intended access restrictions. This can have severe consequences, including unauthorized data disclosure, privilege escalation, or even a complete system compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.12, < 1.12.11.12.1pip install --upgrade "koji==1.12.1" -
>= 1.13, < 1.13.11.13.1pip install --upgrade "koji==1.13.1" -
>= 1.14, < 1.14.11.14.1pip install --upgrade "koji==1.14.1" -
>= 1.15, < 1.15.11.15.1pip install --upgrade "koji==1.15.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the patched versions as soon as possible to mitigate the risk of exploitation.
Conclusion
The vulnerability in Koji's access control can have severe consequences, including unauthorized access to the filesystem and potential compromise of sensitive data. It is crucial to upgrade to the patched versions (1.12.1, 1.13.1, 1.14.1, or 1.15.1) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for koji →
FAQ
Koji is an open-source build system used for creating and managing software packages.
Koji versions 1.12, 1.13, 1.14, and 1.15 are affected.
The vulnerability allows unauthorized filesystem read/write access, which can lead to data disclosure, privilege escalation, or system compromise.
Upgrade to the patched versions of Koji: 1.12.1, 1.13.1, 1.14.1, or 1.15.1.
No, there is no known workaround. Upgrading to the patched versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for koji.
