Path traversal in librepo - CVE-2020-14352

Vulnerability identifier: #VU47485

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-14352

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in remote repository metadata. A remote attacker with control over the repository can trick the victim into downloading software and copy files outside of the destination directory on the targeted system. Successful exploitation of the vulnerability may result in system compromise.

librepo
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
CentOS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
SUSE Linux
Opensuse
openEuler
Fedora
createrepo_c
libdnf
librepo (Red Hat package)
librepo-debuginfo
librepo-devel
python3-librepo
librepo
python2-librepo
librepo-debugsource
dnf-plugins-extras
dnf-plugins-core
dnf
livecd-tools
OpenShift Virtualization
Red Hat OpenShift Container Platform

Install update from vendor's website.

librepo - update to 1.12.1
createrepo_c - addressed in versions 0.16.1-1.fc33, 0.16.1-2.fc32
libdnf - update to 0.54.2-1.fc32
librepo (Red Hat package) - addressed in versions 1.8.1-8.el7_9, 1.9.2-2.el8_0, 1.10.3-4.el8_1, 1.11.0-3.el8_2
librepo-debuginfo - update to 1.12.0-2
librepo-devel - update to 1.12.0-2
python3-librepo - update to 1.12.0-2
librepo - update to 1.12.0-2
python2-librepo - update to 1.12.0-2
librepo-debugsource - update to 1.12.0-2
librepo - addressed in versions 1.12.1-1.fc31, 1.12.1-1.fc32, 1.12.1-1.fc33
OpenShift Virtualization - update to 2.4.2
dnf-plugins-extras - addressed in versions 4.0.12-1.fc32, 4.0.12-1.fc33
dnf-plugins-core - addressed in versions 4.0.18-1.fc32, 4.0.18-1.fc33
Red Hat OpenShift Container Platform - update to 4.3.40
dnf - update to 4.4.0-1.fc32
livecd-tools - addressed in versions 27.1-8.fc32, 27.1-8.fc33

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00072.html
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00055.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1866498

• Path traversal in RPM librepo
• OpenSUSE Linux update for librepo
• OpenSUSE Linux update for librepo
• Red Hat Enterprise Linux 7 update for librepo
• CentOS 7 update for librepo
• Red Hat Enterprise Linux 8 update for librepo
• Red Hat Enterprise Linux 8.1 Extended Update Support update for librepo
• Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions update for librepo
• openEuler update for librepo
• Multiple vulnerabilities in OpenShift Virtualization 2.4
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.3
• Fedora 33 update for createrepo_c, dnf-plugins-core, dnf-plugins-extras, librepo, livecd-tools
• Fedora 32 update for createrepo_c, dnf, dnf-plugins-core, dnf-plugins-extras, libdnf, librepo, livecd-tools
• Fedora 31 update for librepo