CVE-2019-17109 koji hub allows arbitrary upload destinations
Remote attackers can exploit directory traversal in Koji to achieve privilege escalation, requiring immediate upgrades.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-17109?
CVE-2019-17109 is a medium-severity path traversal vulnerability in n/a, published on 9 Oct 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation.
Weakness: CWE-22
Which versions are affected by CVE-2019-17109?
11 open source packages ship an affected version, including koji. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
koji PyPI | All versions | 1.19.0 |
koji PyPI | From 1.14.0 | 1.14.3 |
koji PyPI | From 1.14.0 | 1.14.3 |
koji PyPI | From 1.15.0 | 1.15.3 |
koji PyPI | From 1.15.0 | 1.15.3 |
koji PyPI | From 1.16.0 | 1.16.3 |
5 more packages
koji PyPI | From 1.16.0 | 1.16.3 |
koji PyPI | From 1.17.0 | 1.17.1 |
koji PyPI | From 1.17.0 | 1.17.1 |
koji PyPI | From 1.18.0 | 1.18.1 |
koji PyPI | From 1.18.0 | 1.18.1 |
Products include Koji Project Koji.
How do I fix CVE-2019-17109?
Upgrade koji to a fixed version for your release line: 1.19.0, 1.14.3, 1.15.3 or 1.16.3.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-17109 being exploited?
There is no known exploitation of CVE-2019-17109 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7498-c9fm-g64p, MGASA-2021-0147, PYSEC-2019-183, UBUNTU-CVE-2019-17109.