{"action":"Upgrade koji to 1.14.3 or later.","affected":[{"fixed":"1.14.3","introduced":"1.14.0"},{"fixed":"1.15.3","introduced":"1.15.0"},{"fixed":"1.16.3","introduced":"1.16.0"},{"fixed":"1.17.1","introduced":"1.17.0"},{"fixed":"1.18.1","introduced":"1.18.0"}],"component":"koji","cve_ids":["CVE-2019-17109"],"ecosystem":"PyPI","epss":0.03153,"exploited":false,"fixed_versions":["1.14.3","1.15.3","1.16.3","1.17.1","1.18.1"],"ghsa_id":"GHSA-7498-c9fm-g64p","id":"tcs_01M5KF4SPAPGBGW5Z8BV7VNNR5","modified_at":"2024-09-27T18:35:02.936724Z","published_at":"2022-05-24T16:58:31Z","references":["https://osv.dev/vulnerability/GHSA-7498-c9fm-g64p","https://nvd.nist.gov/vuln/detail/CVE-2019-17109","https://github.com/koji-project/koji/commit/91d6f0b607c7f5af666dfb56931f1db4e38c28a5","https://docs.pagure.org/koji/CVE-2019-17109","https://github.com/koji-project/koji","https://github.com/koji-project/koji/blob/d0507c4d2d2269daa984db642e3bd957dff18948/docs/source/CVEs/CVE-2019-17109.rst","https://github.com/pypa/advisory-database/tree/main/vulns/koji/PYSEC-2019-183.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BGUXMZIAQFFNNQ7PEFDAYQCXXKJR76U","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7PSCCFHLNVFLDPC7DB4UJGXD6ZWBSY57","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DEQYYGWLJBQQVTAC7E7XSDGVF27NPMPB","https://pagure.io/koji/commits/master","https://pagure.io/koji/issue/1634","https://pagure.io/koji/pull-request/1686","http://www.openwall.com/lists/oss-security/2019/10/09/5"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-7498-c9fm-g64p","url":"https://osv.dev/vulnerability/GHSA-7498-c9fm-g64p"}],"summary":"koji hub allows arbitrary upload destinations"}