affected:
- package:
    ecosystem: PyPI
    name: koji
    purl: pkg:pypi/koji
  ranges:
  - events:
    - introduced: '0'
    type: ECOSYSTEM
  versions:
  - 1.15.0
  - 1.16.0
  - 1.16.1
  - 1.17.0
  - 1.18.0
  - 1.19.0
  - 1.19.1
  - 1.20.0
  - 1.20.1
  - 1.21.0
  - 1.21.1
  - 1.22.0
  - 1.22.1
  - 1.23.0
  - 1.23.1
  - 1.24.0
  - 1.24.1
  - 1.25.0
  - 1.25.1
  - 1.26.0
  - 1.26.1
  - 1.27.0
  - 1.27.1
  - 1.28.0
  - 1.28.1
  - 1.29.0
  - 1.29.1
  - 1.30.0
  - 1.30.1
  - 1.31.0
  - 1.31.1
  - 1.32.0
  - 1.32.1
  - 1.33.0
  - 1.33.1
  - 1.33.2
  - 1.34.0
  - 1.34.1
  - 1.34.2
  - 1.34.3
  - 1.35.0
  - 1.35.1
  - 1.35.2
  - 1.35.3
  - 1.36.0
aliases:
- CVE-2017-1002153
- GHSA-vwp5-w4rq-g4cc
details: Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to
  work around blacklisted paths for build submission.
id: PYSEC-2017-144
modified: '2026-06-10T16:51:28.507375Z'
published: '2017-10-06T17:29:00Z'
references:
- type: REPORT
  url: https://pagure.io/koji/issue/563
- type: FIX
  url: https://pagure.io/koji/issue/563
- type: ADVISORY
  url: https://github.com/advisories/GHSA-vwp5-w4rq-g4cc
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  type: CVSS_V3
withdrawn: '2024-11-22T04:37:04Z'