Vulnerabilities

TI-2019-12765 CVE-2019-17109 · GHSA-7498-c9fm-g64p

Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation.

LOW 35

Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03214 Published 2019-10-09 Fixed in 1.14.3, 1.15.3 +3 CWE-22

TI-2018-16131 CVE-2018-1002150 · GHSA-6mww-xvh7-fq4f

MEDIUM 43

Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write access.

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.01658 Published 2018-04-04 Fixed in 1.15.1, 1.14.1 +2 CWE-732

TI-2017-14760 CVE-2017-1002153 · GHSA-vwp5-w4rq-g4cc

LOW 35

Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01184 Published 2017-10-06 Fixed in 1.15.0 CWE-20