koji

#4204 Fix CVE-2024-9427
Closed: Fixed by mikem. Opened by mikem.

Closed: Fixed
Reopen Issue

An unsanitized input allows for an XSS attack. Javascript code from a malicious link could be reflected in the resulting web page. At present, we do not believe that this can be used to submit an action or make a change in Koji due to existing XSS protections in the code. Even so, this is a serious issue and we recommend applying this update promptly.

We are also fixing this issue for releases from the past year. For those backports, see:

  • 1.34 -- https://pagure.io/koji/issue/4211
  • 1.33 -- https://pagure.io/koji/issue/4212

See also: https://docs.pagure.org/koji/CVEs/CVE-2024-9427/

ProdSec CVE bugs for Fedora and EPEL

  • main: https://bugzilla.redhat.com/show_bug.cgi?id=2316047
  • fedora: https://bugzilla.redhat.com/show_bug.cgi?id=2316304
  • epel: https://bugzilla.redhat.com/show_bug.cgi?id=2316303
Edited by mikem

Metadata Update from @mikem:
- Custom field Size adjusted to None

Metadata Update from @mikem:
- Issue set to the milestone: 1.35.1

Metadata Update from @mikem:
- Issue private status set to: False (was: True)

Commit 8c72d90d fixes this issue

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/koji/issues/4204

Please continue any further discussion there.
Metadata
None

bug

None
None
Lowest
None
Related Pull Requests
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.