Koji hub call führt keine korrekten Zugriffsprüfungen durch

The impact of this vulnerability is severe. An attacker exploiting CVE-2018-1002150 can read and write any file on the system where Koji is running, effectively gaining full control. This could involve stealing sensitive data (passwords, API keys, source code), modifying system files, installing malware, or pivoting to other systems on the network. The ability to write files allows for persistent backdoors and complete compromise of the build environment. This vulnerability is particularly concerning given Koji's role in managing build artifacts, which could be maliciously altered and distributed.

Organizations using Koji to manage RPM packages, particularly those running older, unpatched versions (≤1.15.0), are at significant risk. Shared hosting environments where Koji instances are deployed alongside other applications are also vulnerable, as a compromise of Koji could potentially impact other services.

• linux / server:

journalctl -u koji | grep -i "access denied"

• python:

import os
# Check for unusual file permissions in Koji's data directory
for root, dirs, files in os.walk('/path/to/koji/data'): # Replace with actual path
    for file in files:
        filepath = os.path.join(root, file)
        if os.access(filepath, os.W_OK):
            print(f"Warning: Writeable file found: {filepath}")

1. 2018-07-12Disclosure

   disclosure

1. Veröffentlicht2018-07-12
2. Geändert2025-02-18
3. EPSS aktualisiert2026-04-02

The primary mitigation is to upgrade Koji to a patched version (1.12.1, 1.13.1, 1.14.1, or 1.15.1). If an immediate upgrade is not possible due to compatibility issues or downtime constraints, consider implementing stricter filesystem permissions around the Koji data directory to limit the potential impact of a successful exploit. Review and restrict user access to the Koji system, ensuring only authorized personnel have access. Monitor Koji logs for suspicious activity, particularly attempts to access files outside of expected directories. Consider implementing a Web Application Firewall (WAF) to filter requests and block attempts to exploit the vulnerability, although this is not a substitute for patching.