PR#1687: Docs updates for CVE-2019-17109 - koji

Mike McLean • 4 years ago

af66445

Mike McLean • 4 years ago

dd09e81

Mike McLean • 4 years ago

e76aa3d

Mike McLean • 4 years ago

f2f3d19

docs/source/CVE-2019-17109.rst

file added

+49

		`@@ -0,0 +1,49 @@`
		`+ ==============`
		`+ CVE-2019-17109`
		`+ ==============`
		`+`
		`+ Koji hub allows arbitrary upload destinations`
		`+`
		`+`
		`+ Summary`
		`+ -------`
		`+`
		`+ The way that the hub code validates upload paths allows for an attacker to`
		`+ choose an arbitrary destination for the uploaded file.`
		`+`
		`+ Uploading still requires login. However, an attacker with credentials could`
		`+ damage the integrity of the Koji system.`
		`+`
		`+ There is no known workaround. All Koji admins are encouraged to update to a`
		`+ fixed version as soon as possible.`
		`+`
		`+`
		`+`
		`+ Bug fix`
		`+ -------`
		`+`
		`+ We are releasing updates for each affected version of Koji to fix this bug.`
		`+ The following releases all contain the fix:`
		`+`
		`+ - 1.18.1`
		`+ - 1.17.1`
		`+ - 1.16.3`
		`+ - 1.15.3`
		`+ - 1.14.3`
		`+`
		`+ Note: the legacy-py24 branch is unaffected since it is client-only (no hub).`
		`+`
		`+ For users who have customized their Koji code, we recommend rebasing your work`
		`+ onto the appropriate update release. Please see Koji`
		+ `issue #1634 <https://pagure.io/koji/issue/1634>`_ for the code details.
		`+`
		`+ As with all changes to hub code, you must restart httpd for the changes to`
		`+ take effect.`
		`+`
		`+`
		`+ Links`
		`+ -----`
		`+`
		`+ Fixed versions can be found at our releases page:`
		`+`
		`+ https://pagure.io/koji/releases`

docs/source/CVEs.rst

file modified

docs/source/conf.py

file modified

+1 -1

		`@@ -56,7 +56,7 @@`
		`# The short X.Y version.`
		`version = '1.18'`
		`# The full version, including alpha/beta/rc tags.`
		`- release = '1.18.0'`
		`+ release = '1.18.1'`

		`# The language for content autogenerated by Sphinx. Refer to documentation`
		`# for a list of supported languages.`

docs/source/release_notes.rst

file modified

docs/source/release_notes_1.18.1.rst

file added

+12

		`@@ -0,0 +1,12 @@`
		`+ Koji 1.18.1 Release Notes`
		`+ =========================`
		`+`
		`+ Koji 1.18.1 is a bugfix release for Koji 1.18.`
		+ The purpose of this release is address :doc:`CVE-2019-17109`.
		`+`
		`+`
		`+ Issues fixed in 1.18.1`
		`+ ----------------------`
		`+`
		+ - `Issue 1634 <https://pagure.io/koji/issue/1634>`_ --
		`+ possible to upload file to a path other than work directory`

koji.spec

file modified

+1 -1

		`@@ -81,7 +81,7 @@`
		`%define release %{baserelease}`
		`%endif`
		`Name: koji`
		`- Version: 1.18.0`
		`+ Version: 1.18.1`
		`Release: %{release}%{?dist}`
		`License: LGPLv2 and GPLv2+`
		`# the included arch lib from yum's rpmUtils is GPLv2+`

setup.py

file modified

+1 -1

		`@@ -32,7 +32,7 @@`

		`setup(`
		`name="koji",`
		`- version="1.18.0",`
		`+ version="1.18.1",`
		`description=("Koji is a system for building and tracking RPMS. The base"`
		`" package contains shared libraries and the command-line"`
		`" interface."),`