GHSA-7498-C9FM-G64P koji hub allows arbitrary upload destinations

The way that the hub code validates upload paths allows for an attacker to choose an arbitrary destination for the uploaded file. Uploading still requires login. However, an attacker with credentials could damage the integrity of the Koji system. Workaround There is no known workaround. All Koji...

GHSA-6MWW-XVH7-FQ4F Koji hub call does not perform correct access checks

Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write access. This vulnerability has been fixed in versions 1.12.1, 1.13.1, 1.14.1 and 1.15.1...