NVD Vulnerability Detail

CVE-2019-17109

Summary	Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation.
Publication Date	Oct. 10, 2019, 7:15 a.m.
Registration Date	Jan. 26, 2021, 11:40 a.m.
Last Update	Nov. 21, 2024, 1:31 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:koji_project:koji::::::::			1.18.0

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2019/10/09/5	Mailing List Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2019/10/09/5	Mailing List Third Party Advisory
3	https://docs.pagure.org/koji/CVE-2019-17109/	Vendor Advisory
4	https://docs.pagure.org/koji/CVE-2019-17109/	Vendor Advisory
5	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BGUXMZIAQFFNNQ7PEFDAYQCXXKJR76U/
6	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BGUXMZIAQFFNNQ7PEFDAYQCXXKJR76U/
7	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7PSCCFHLNVFLDPC7DB4UJGXD6ZWBSY57/
8	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7PSCCFHLNVFLDPC7DB4UJGXD6ZWBSY57/
9	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DEQYYGWLJBQQVTAC7E7XSDGVF27NPMPB/
10	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DEQYYGWLJBQQVTAC7E7XSDGVF27NPMPB/
11	https://pagure.io/koji/commits/master	Vendor Advisory
12	https://pagure.io/koji/commits/master	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html

JVN Vulnerability Information

Koji におけるパストラバーサルの脆弱性

Title	Koji におけるパストラバーサルの脆弱性
Summary	Koji には、パストラバーサルの脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 9, 2019, midnight
Registration Date	Oct. 17, 2019, 10:46 a.m.
Last Update	Oct. 17, 2019, 10:46 a.m.

Affected System

Koji project

Koji 1.18.0 まで

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-17109	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17109
National Vulnerability Database (NVD)
2	CVE-2019-17109	https://nvd.nist.gov/vuln/detail/CVE-2019-17109
Pagure
3	CVE-2019-17109	https://docs.pagure.org/koji/CVE-2019-17109/

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

No	Name	URL
Pagure
1	Commits 4542	https://pagure.io/koji/commits/master

その他

No	Name	URL
関連文書
1	Koji CVE-2019-17109: koji hub allows arbitrary upload destinations	https://www.openwall.com/lists/oss-security/2019/10/09/5

Change Log

No	Changed Details	Date of change
1	[2019年10月17日] 掲載	Oct. 17, 2019, 10:46 a.m.