id: PYSEC-2019-183
details: Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege
  Escalation.
affected:
- package:
    name: koji
    ecosystem: PyPI
    purl: pkg:pypi/koji
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.19.0
  versions:
  - 1.15.0
  - 1.16.0
  - 1.16.1
  - 1.17.0
  - 1.18.0
references:
- type: WEB
  url: https://docs.pagure.org/koji/CVE-2019-17109/
- type: WEB
  url: https://pagure.io/koji/commits/master
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2019/10/09/5
- type: WEB
  url: 
    https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7PSCCFHLNVFLDPC7DB4UJGXD6ZWBSY57/
- type: WEB
  url: 
    https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BGUXMZIAQFFNNQ7PEFDAYQCXXKJR76U/
- type: WEB
  url: 
    https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DEQYYGWLJBQQVTAC7E7XSDGVF27NPMPB/
- type: ADVISORY
  url: https://github.com/advisories/GHSA-7498-c9fm-g64p
aliases:
- CVE-2019-17109
- GHSA-7498-c9fm-g64p
modified: "2021-08-27T03:22:05.900614Z"
published: "2019-10-09T22:15:00Z"