CVE-2019-17109

CVE-2019-17109 affects Koji up to version 1.18.0, where remote Directory Traversal can lead to Privilege Escalation. Public sources (including Mageia MGASA-2021-0147 and OSV entries) confirm the issue and cite fixes in Koji releases around 1.17.x/1.18.1. The vulnerability is due to improper valid...

CVE-2018-1002150

CVE-2018-1002150 affects Koji hub, with versions 1.12, 1.13, 1.14 and 1.15 featuring an incorrect access control vulnerability that allows arbitrary filesystem read/write. The issue has been fixed in 1.12.1, 1.13.1, 1.14.1 and 1.15.1. CVSS data in the connected sources indicate a high/critical im...

CVE-2017-1002153

Koji 1.13.0 contains a flaw where SCM paths are not properly validated, allowing an attacker to bypass the blacklisted paths during build submission. This is CVE-2017-1002153. The connected sources specify the root cause (improper SCM path validation) and the affected version, with no remediation...