Improper access control in Koji - CVE-2018-1002150

Vulnerability identifier: #VU12764

CSH Severity: Low

CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1002150

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information and write arbitrary files on the target system.

The weakness exists in the host.distRepoMove hub call due to improper access control. A remote attacker can gain read/write access.

Koji
Fedora

Update to versions 1.12.1, 1.13.1, 1.14.1 or 1.15.1.

Koji - addressed in versions 1.15.1-1.el6, 1.15.1-1.el7, 1.15.1-1.fc26, 1.15.1-1.fc27, 1.15.1-1.fc28

• https://docs.pagure.org/koji/CVE-2018-1002150/

• Information disclosure in Koji
• Fedora EPEL 6 update for koji
• Fedora 26 update for koji
• Fedora 28 update for koji
• Fedora EPEL 7 update for koji
• Fedora 27 update for koji