Advisory ROSA-SA-2021-1886

Software: librepo 1.8.1
OS: Cobalt 7.9

CVE-ID: CVE-2020-14352
CVE-Crit: HIGH
CVE-DESC: A bug was discovered in librepo in versions prior to 1.12.1. A directory traversal vulnerability was discovered where paths in remote repository metadata could not be cleared. An attacker controlling a remote repository could copy files outside of the destination directory on the target system via path traversal. This flaw has the potential to compromise a system by overwriting critical system files. The biggest threat from this vulnerability is to users who use untrusted third-party repositories.
CVE-STATUS: default
CVE-REV: default