CVE-2020-14352 Path traversal in librepo

High 8.0 Published 30 Aug 2020 Updated 4 Aug 2024

An attacker controlling a remote repository can overwrite critical system files via path traversal in librepo, potentially leading to system compromise.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2020-14352?

CVE-2020-14352 is a high-severity path traversal vulnerability in Fedoraproject Fedora, published on 30 Aug 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.

Weakness: CWE-22

Which versions are affected by CVE-2020-14352?

It affects 4 products.

Linux distribution packages (35)

`librepo` Red Hat:enterprise_linux:7::client	All versions	`0:1.8.1-8.el7_9`
`librepo-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:1.8.1-8.el7_9`
`librepo-devel` Red Hat:enterprise_linux:7::client	All versions	`0:1.8.1-8.el7_9`
`python-librepo` Red Hat:enterprise_linux:7::client	All versions	`0:1.8.1-8.el7_9`
`librepo` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.8.1-8.el7_9`
`librepo-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.8.1-8.el7_9`
`librepo-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.8.1-8.el7_9`
`python-librepo` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.8.1-8.el7_9`
`librepo` Red Hat:enterprise_linux:7::server	All versions	`0:1.8.1-8.el7_9`
`librepo-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:1.8.1-8.el7_9`
`librepo-devel` Red Hat:enterprise_linux:7::server	All versions	`0:1.8.1-8.el7_9`
`python-librepo` Red Hat:enterprise_linux:7::server	All versions	`0:1.8.1-8.el7_9`
`librepo` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.8.1-8.el7_9`
`librepo-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.8.1-8.el7_9`
`librepo-devel` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.8.1-8.el7_9`
`python-librepo` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.8.1-8.el7_9`
`librepo` Red Hat:enterprise_linux:8::baseos	All versions	`0:1.11.0-3.el8_2`
`librepo-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:1.11.0-3.el8_2`
`librepo-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:1.11.0-3.el8_2`
`python3-librepo` Red Hat:enterprise_linux:8::baseos	All versions	`0:1.11.0-3.el8_2`
`python3-librepo-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:1.11.0-3.el8_2`
`librepo` Red Hat:rhel_e4s:8.0::baseos	All versions	`0:1.9.2-2.el8_0`
`librepo-debuginfo` Red Hat:rhel_e4s:8.0::baseos	All versions	`0:1.9.2-2.el8_0`
`librepo-debugsource` Red Hat:rhel_e4s:8.0::baseos	All versions	`0:1.9.2-2.el8_0`
`python3-librepo` Red Hat:rhel_e4s:8.0::baseos	All versions	`0:1.9.2-2.el8_0`
`python3-librepo-debuginfo` Red Hat:rhel_e4s:8.0::baseos	All versions	`0:1.9.2-2.el8_0`
`librepo` Red Hat:rhel_eus:8.1::baseos	All versions	`0:1.10.3-4.el8_1`
`librepo-debuginfo` Red Hat:rhel_eus:8.1::baseos	All versions	`0:1.10.3-4.el8_1`
`librepo-debugsource` Red Hat:rhel_eus:8.1::baseos	All versions	`0:1.10.3-4.el8_1`
`python3-librepo` Red Hat:rhel_eus:8.1::baseos	All versions	`0:1.10.3-4.el8_1`
`python3-librepo-debuginfo` Red Hat:rhel_eus:8.1::baseos	All versions	`0:1.10.3-4.el8_1`
`librepo` SUSE:Package Hub 15 SP2	All versions	`1.11.2-bp152.2.3.1`
`librepo` SUSE:Package Hub 15 SP2	All versions	`1.12.1-bp152.2.6.1`
`librepo` openSUSE:Leap 15.2	All versions	`1.11.2-lp152.2.3.1`
`librepo` openSUSE:Leap 15.2	All versions	`1.12.1-lp152.2.6.1`

Products include Fedoraproject Fedora, Opensuse Backports Sle, Opensuse Leap, Redhat Librepo.

How do I fix CVE-2020-14352?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2020-14352 being exploited?

There is no known exploitation of CVE-2020-14352 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as GHSA-2fcv-8cvq-hmxh, MGASA-2020-0429, OESA-2021-1055, RHSA-2020:3658, RHSA-2020:3749, RHSA-2020:3756 and 6 more.