koji

#1183 fix query parameter processing in multiple calls
Closed: Fixed by mikem. Opened by mikem.

Closed: Fixed
Reopen Issue

The following functions use unsafe techniques to handle some of their query parameters: list_archives, get_archive_type, and listHosts.
These bugs allow an attacker to inject arbitrary sql commands.

This issue has been assigned CVE-2018-1002161

You can read the full announcement here:
https://docs.pagure.org/koji/CVE-2018-1002161/

Metadata Update from @mikem:
- Issue private status set to: False (was: True)

Commit bdec8c73 fixes this issue

Fixed in pr #1274

Metadata Update from @mikem:
- Issue priority set to: High (was: Normal)
- Issue set to the milestone: 1.17
- Issue tagged with: bug

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/koji/issues/1183

Please continue any further discussion there.
Metadata
None

bug

None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.