GitHub Advisoryadvisory · PyPI

GHSA-vwp5-w4rq-g4cc Koji blacklisted paths workaround

HIGH Published 2022-05-13 Modified 2026-06-10 Official page ↗

Aliases: CVE-2017-1002153
Ecosystem: PyPI
Packages: koji
Severity: High
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses: CWE-20
Reviewed: 2024-11-22

Affected packages

• PyPI koji: < 1.15.0 → fixed in 1.15.0

Description

Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.

Related

Alias · CVE (1)

CVE-2017-1002153 Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission. vulnerability

Weakness · CWE (1)

CWE-20 Improper Input Validation weakness

References