Bug#942146: koji: CVE-2019-17109

2020-01-25 Thread Moritz Mühlenhoff
On Thu, Jan 23, 2020 at 07:46:49PM +, Holger Levsen wrote: > On Thu, Jan 23, 2020 at 08:42:03PM +0100, Moritz Muehlenhoff wrote: > > Let's remove it in the upcoming stretch/buster point releases, then? > > seems reasonable to me. Can you please file RM bugs against release.debian.org? Typical

Bug#942146: koji: CVE-2019-17109

2020-01-23 Thread Holger Levsen
On Thu, Jan 23, 2020 at 08:42:03PM +0100, Moritz Muehlenhoff wrote: > Let's remove it in the upcoming stretch/buster point releases, then? seems reasonable to me. -- cheers, Holger --- holger@(de

Bug#942146: koji: CVE-2019-17109

2020-01-23 Thread Moritz Muehlenhoff
On Thu, Jan 23, 2020 at 04:37:15PM +, Holger Levsen wrote: > Hi Salvatore, > > On Sun, Jan 05, 2020 at 09:02:20PM +0100, Salvatore Bonaccorso wrote: > > Any news on this issue? AFAICT, the issue is fixed as well in 1.16.3, > > so the smaller jump should be possible. Once fixed in unstable, can

Bug#942146: koji: CVE-2019-17109

2020-01-23 Thread Holger Levsen
Hi Salvatore, On Sun, Jan 05, 2020 at 09:02:20PM +0100, Salvatore Bonaccorso wrote: > Any news on this issue? AFAICT, the issue is fixed as well in 1.16.3, > so the smaller jump should be possible. Once fixed in unstable, can > you adress the issue as well via point release? I think it's pointles

Bug#942146: koji: CVE-2019-17109

2020-01-05 Thread Salvatore Bonaccorso
Hi Holger! On Thu, Oct 10, 2019 at 10:57:50PM +0200, Salvatore Bonaccorso wrote: > The following vulnerability was published for koji. > > CVE-2019-17109[0]: > | Koji through 1.18.0 allows remote Directory Traversal, with resultant > | Privilege Escalation. > > > If you fix the vulnerability pl

Bug#942146: koji: CVE-2019-17109

2019-10-10 Thread Salvatore Bonaccorso
Source: koji Version: 1.16.2-1 Severity: grave Tags: security upstream Justification: user security hole Forwarded: https://pagure.io/koji/issue/1634 Hi, The following vulnerability was published for koji. CVE-2019-17109[0]: | Koji through 1.18.0 allows remote Directory Traversal, with resultant