Path traversal in librepo
Priority MEDIUM 40CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.
Why it matters now
EPSS 0.02526 84th percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | librepo | librepo versions before 1.12.1 | — | No fix listed | CNA |
- librepo Vendor— Affected librepo versions before 1.12.1 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:librepo:*:*:*:*:*:*:*:* | before 1.12.1 | Vulnerable | Red Hat |
| cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:* | 15.0 sp2 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* | 15.2 | Vulnerable | openSUSE |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
- cpe:2.3:a:redhat:librepo:*:*:*:*:*:*:*:* Versions before 1.12.1 Vulnerable ·Red Hat
- cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:* Versions 15.0 sp2 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
Remediation
Red Hat 4 advisories
- RHSA-2020:5012 Released 2020-11-10 · Red Hat rating Moderatelibrepo security update
- Red Hat Enterprise Linux Client (v. 7) librepo-1.8.1-8.el7_9
- Red Hat Enterprise Linux Client Optional (v. 7) librepo-devel-1.8.1-8.el7_9, python-librepo-1.8.1-8.el7_9
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) librepo-1.8.1-8.el7_9, librepo-devel-1.8.1-8.el7_9, python-librepo-1.8.1-8.el7_9
- Red Hat Enterprise Linux Server (v. 7) librepo-1.8.1-8.el7_9, librepo-1.8.1-8.el7_9.ppc
- Red Hat Enterprise Linux Server Optional (v. 7) librepo-devel-1.8.1-8.el7_9, librepo-devel-1.8.1-8.el7_9.ppc, python-librepo-1.8.1-8.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) librepo-1.8.1-8.el7_9
- Red Hat Enterprise Linux Workstation Optional (v. 7) librepo-devel-1.8.1-8.el7_9, python-librepo-1.8.1-8.el7_9
- RHSA-2020:3756 Released 2020-09-15 · Red Hat rating Importantlibrepo security update
- Red Hat Enterprise Linux BaseOS E4S (v. 8.0) librepo-1.9.2-2.el8_0, python3-librepo-1.9.2-2.el8_0
- RHSA-2020:3749 Released 2020-09-15 · Red Hat rating Importantlibrepo security update
- Red Hat Enterprise Linux BaseOS EUS (v. 8.1) librepo-1.10.3-4.el8_1, python3-librepo-1.10.3-4.el8_1
Show 1 more Red Hat advisories
- RHSA-2020:3658 Released 2020-09-08 · Red Hat rating Importantlibrepo security update
- Red Hat Enterprise Linux BaseOS (v. 8) librepo-1.11.0-3.el8_2, python3-librepo-1.11.0-3.el8_2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2020:3658 |
| Red Hat Enterprise Linux BaseOS E4S (v. 8.0) | Fixed | RHSA-2020:3756 |
| Red Hat Enterprise Linux BaseOS EUS (v. 8.1) | Fixed | RHSA-2020:3749 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2020:5012 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2020:5012 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2020:5012 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:5012 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2020:5012 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:5012 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2020:5012 |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-14352
- 2026-10-03 Alias added: GHSA-2fcv-8cvq-hmxh
References
Sources
- CVE-2020-14352 · CVE Program
- CVE-2020-14352 · NVD
- FIRST EPSS
- GHSA-2fcv-8cvq-hmxh · GitHub Advisory Database · CC BY 4.0
- CVE-2020-14352 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences