pagure

#5484 fix: Path traversal in view_issue_raw_file()
Merged by wombelix. Opened by wombelix.
wombelix/pagure fix_security_issue_rhbz2280728_rhbz2279411_path_traversal  into  master

Download 5484.patch

Use 'werkzeug.security.safe_join()' instead of plain 'os.path.join()'
to sanitize user-provided filename variable and avoid escaping the base directory.

Vulnerability discovered by Thomas Chauchefoin thomas@chauchefoin.fr

Fixes: rhbz#2279411, rhbz#2280728, rhbz#2280726, CVE-2024-4982

Signed-off-by: Dominik Wombacher dominik@wombacher.cc

Metadata Update from @wombelix:
- Request assigned

Patch reviewed and validated in Bugzilla. Tests performed locally, all passed.

rebased onto 9e1a5c49cfbc730fd361d87eeb6be74fca6cf6a7

Pull-Request has been merged by wombelix
Metadata
wombelix
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.