Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A vulnerability in Koji was found. An unsanitized input allows for an XSS attack. Javascript code from a malicious link could be reflected in the resulting web page. It is not expected to be able to submit an action or make a change in Koji due to existing XSS protections in the code.
Recommended action: Upgrade to 1.35.1, 1.34.3 or 1.33.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
1.14.31.17.11.15.31.18.11.16.3· Vendor fix available
Issue
The way that the hub code validates upload paths allows for an attacker to choose an arbitrary destination for the uploaded file. Uploading still requires login. However, an attacker with credentials could damage the integrity of the Koji system. Workaround There is no known workaround. All Koji admins are encouraged to update to a fixed version as soon as possible. Fix Koji versions 1.14.3, 1.15.3, 1.16.3, 1.17.1, and 1.18.1 all include patches to solve this vulnerability.
Recommended action: Upgrade to 1.18.1, 1.17.1, 1.16.3 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.
Recommended action: Upgrade to 1.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write access. This vulnerability has been fixed in versions 1.12.1, 1.13.1, 1.14.1 and 1.15.1.
Recommended action: Upgrade to 1.15.1, 1.14.1, 1.13.1 or 1.12.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.