pagure

#5483 fix: _update_file_in_git() follows symbolic links in temporary clones
Merged by wombelix. Opened by wombelix.
wombelix/pagure fix_security_issue_rhbz2280725_rhbz2278745_follow_symlink  into  master

Download 5483.patch

Bail out if file path is outside the temp repo or inside the '.git/' folder.
This avoids data leak and unauthorized changes in files or git config.

Vulnerability discovered by Thomas Chauchefoin thomas@chauchefoin.fr

Fixes: rhbz#2278745, rhbz#2280725, rhbz#2280723, CVE-2024-4981

Signed-off-by: Dominik Wombacher dominik@wombacher.cc

Metadata Update from @wombelix:
- Request assigned

Patch reviewed and validated in Bugzilla. Tests performed locally, all passed.

rebased onto 2803a7ac66636153865e9238e48018b90ace0999

Pull-Request has been merged by wombelix
Metadata
wombelix
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.