A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has librepo packages installed that are affected by a vulnerability:

  - A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where     it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may     be able to copy files outside of the destination directory on the targeted system via path traversal. This     flaw could potentially result in system compromise via the overwriting of critical system files. The     highest threat from this flaw is to users that make use of untrusted third-party repositories.
    (CVE-2020-14352)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the librepo packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A flaw was found in librepo in versions before 1.12.1.
    A directory traversal vulnerability was found where it     failed to sanitize paths in remote repository metadata.
    An attacker controlling a remote repository may be able     to copy files outside of the destination directory on     the targeted system via path traversal. This flaw could     potentially result in system compromise via the     overwriting of critical system files. The highest     threat from this flaw is to users that make use of     untrusted third-party repositories.(CVE-2020-14352)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the librepo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A flaw was found in librepo in versions before 1.12.1.
    A directory traversal vulnerability was found where it     failed to sanitize paths in remote repository metadata.
    An attacker controlling a remote repository may be able     to copy files outside of the destination directory on     the targeted system via path traversal. This flaw could     potentially result in system compromise via the     overwriting of critical system files. The highest     threat from this flaw is to users that make use of     untrusted third-party repositories.(CVE-2020-14352)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has librepo packages installed that are affected by a vulnerability:

  - A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where     it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may     be able to copy files outside of the destination directory on the targeted system via path traversal. This     flaw could potentially result in system compromise via the overwriting of critical system files. The     highest threat from this flaw is to users that make use of untrusted third-party repositories.
    (CVE-2020-14352)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has librepo packages installed that are affected by a vulnerability:

  - A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where     it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may     be able to copy files outside of the destination directory on the targeted system via path traversal. This     flaw could potentially result in system compromise via the overwriting of critical system files. The     highest threat from this flaw is to users that make use of untrusted third-party repositories.
    (CVE-2020-14352)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the librepo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found in librepo in versions before 1.12.1.
    A directory traversal vulnerability was found where it     failed to sanitize paths in remote repository metadata.
    An attacker controlling a remote repository may be able     to copy files outside of the destination directory on     the targeted system via path traversal. This flaw could     potentially result in system compromise via the     overwriting of critical system files. The highest     threat from this flaw is to users that make use of     untrusted third-party repositories.(CVE-2020-14352)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for librepo fixes the following issues :

  - Upgrade to 1.12.1

  + Validate path read from repomd.xml (bsc#1175475,     CVE-2020-14352)

  - Changes from 1.12.0

  + Prefer mirrorlist/metalink over baseurl (rh#1775184)

  + Decode package URL when using for local filename     (rh#1817130)

  + Fix memory leak in lr_download_metadata() and     lr_yum_download_remote()

  + Download sources work when at least one of specified is     working (rh#1775184)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:3658 advisory.

  - librepo: missing path validation in repomd.xml may lead to directory traversal (CVE-2020-14352)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5012 advisory.

  - librepo: missing path validation in repomd.xml may lead to directory traversal (CVE-2020-14352)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1568 advisory.

  - A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where     it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may     be able to copy files outside of the destination directory on the targeted system via path traversal. This     flaw could potentially result in system compromise via the overwriting of critical system files. The     highest threat from this flaw is to users that make use of untrusted third-party repositories.
    (CVE-2020-14352)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the librepo packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in librepo in versions before 1.12.1.
    A directory traversal vulnerability was found where it     failed to sanitize paths in remote repository metadata.
    An attacker controlling a remote repository may be able     to copy files outside of the destination directory on     the targeted system via path traversal. This flaw could     potentially result in system compromise via the     overwriting of critical system files. The highest     threat from this flaw is to users that make use of     untrusted third-party repositories.(CVE-2020-14352)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the librepo package has been released.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5012 advisory.

  - A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where     it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may     be able to copy files outside of the destination directory on the targeted system via path traversal. This     flaw could potentially result in system compromise via the overwriting of critical system files. The     highest threat from this flaw is to users that make use of untrusted third-party repositories.
    (CVE-2020-14352)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5012 advisory.

    [1.8.1-8]
    - Validate paths read from repomd.xml (RhBug: 1866500)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5012 advisory.

    The librepo library provides a C and Python API to download repository metadata.

    Security Fix(es):

    * librepo: missing path validation in repomd.xml may lead to directory traversal (CVE-2020-14352)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

createrepo_c 0.16.1

  - Update to 0.16.1

  - Add the section number to the manual pages

  - Parse xml snippet in smaller parts (RhBug:1859689)

  - Add module metadata support to createrepo_c     (RhBug:1795936)

librepo 1.12.1

  - Update to 1.12.1

  - Validate path read from repomd.xml (RhBug:1868639)

libdnf 0.54.2

  - Update to 0.54.2

  - history: Fix dnf history rollback when a package was     removed (RhBug:1683134)

  - Add support for HY_GT, HY_LT in query nevra_strict

  - Fix parsing empty lines in config files

  - Accept '==' as an operator in reldeps (RhBug:1847946)

  - Add log file level main config option (RhBug:1802074)

  - Add protect_running_kernel configuration option     (RhBug:1698145)

  - Context part of libdnf cannot assume zchunk is on     (RhBug:1851841,1779104)

  - Fix memory leak of resultingModuleIndex and handle     g_object refs

  - Redirect librepo logs to libdnf logs with different     source

  - Introduce changelog metadata in commit messages

  - Add hy_goal_lock

  - Update Copr targets for packit and use alias

  - Enum/String conversions for Transaction Store/Replay

  - utils: Add a method to decode URLs

  - Unify hawkey.log line format with the rest of the logs

dnf 4.4.0

  - Update to 4.4.0

  - Handle empty comps group name (RhBug:1826198)

  - Remove dead history info code (RhBug:1845800)

  - Improve command emmitter in dnf-automatic

  - Enhance --querytags and --qf help output

  - [history] add option --reverse to history list     (RhBug:1846692)

  - Add logfilelevel configuration (RhBug:1802074)

  - Don't turn off stdout/stderr logging longer than     necessary (RhBug:1843280)

  - Mention the date/time that updates were applied

  - [dnf-automatic] Wait for internet connection     (RhBug:1816308)

  - [doc] Enhance repo variables documentation     (RhBug:1848161,1848615)

  - Add librepo logger for handling messages from librepo     (RhBug:1816573)

  - [doc] Add package-name-spec to the list of possible     specs

  - [doc] Do not use <package-nevr-spec>

  - [doc] Add section to explain -n, -na and -nevra suffixes

  - Add alias 'ls' for list command

  - README: Reference Fedora Weblate instead of Zanata

  - remove log_lock.pid after reboot(Rhbug:1863006)

  - comps: Raise CompsError when removing a non-existent     group

  - Add methods for working with comps to     RPMTransactionItemWrapper

  - Implement storing and replaying a transaction

  - Log failure to access last makecache time as warning

  - [doc] Document Substitutions class

  - Dont document removed attribute ``reports`` for     get_best_selector

  - Change the debug log timestamps from UTC to local time

dnf-plugins-core 4.0.18

  - [needs-restarting] Fix plugin fail if needs-restarting.d     does not exist

  - [needs-restarting] add kernel-rt to reboot list

  - Fix debug-restore command

  - [config-manager] enable/disable comma separated pkgs     (RhBug:1830530)

  - [debug] Use standard demands.resolving for transaction     handling

  - [debug] Do not remove install-only packages     (RhBug:1844533)

  - return error when dnf download failed

  - README: Reference Fedora Weblate instead of Zanata

  - [reposync] Add latest NEVRAs per stream to download     (RhBug: 1833074)

  - copr: don't try to list runtime dependencies

dnf-plugins-extras 4.0.12

  - Update Cmake to pull translations from weblate

  - Drop Python 2 support

  - README: Add Installation, Contribution, etc

  - Add the DNF_SYSTEM_UPGRADE_NO_REBOOT env variable to     control system-upgrade reboot.

  - [system-upgrade] Upgrade groups and environments     (RhBug:1845562,1860408)

livecd-tools-27.1-8

  - Fix compatibility with dnf 4.4.0 / libdnf 0.54.2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to 1.12.1

  - Validate path read from repomd.xml (RhBug:1868639)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3756 advisory.

    The librepo library provides a C and Python API to download repository metadata.

    Security Fix(es):

    * librepo: missing path validation in repomd.xml may lead to directory traversal (CVE-2020-14352)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3749 advisory.

    The librepo library provides a C and Python API to download repository metadata.

    Security Fix(es):

    * librepo: missing path validation in repomd.xml may lead to directory traversal (CVE-2020-14352)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3658 advisory.

    The librepo library provides a C and Python API to download repository metadata.

    Security Fix(es):

    * librepo: missing path validation in repomd.xml may lead to directory traversal (CVE-2020-14352)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-3658 advisory.

    [1.11.0-3]
    - Validate paths read from repomd.xml (RhBug:1866498)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for librepo fixes the following issues :

  - Fixed path validation to prevent directory traversal     attacks (bsc#1175475, CVE-2020-14352)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

ID	Name	Product	Family	Severity
154568	NewStart CGSL CORE 5.05 / MAIN 5.05 : librepo Vulnerability (NS-SA-2021-0170)	Nessus	NewStart CGSL Local Security Checks	high
147699	EulerOS Virtualization 2.9.0 : librepo (EulerOS-SA-2021-1655)	Nessus	Huawei Local Security Checks	high
147572	EulerOS Virtualization 2.9.1 : librepo (EulerOS-SA-2021-1607)	Nessus	Huawei Local Security Checks	high
147264	NewStart CGSL MAIN 6.02 : librepo Vulnerability (NS-SA-2021-0057)	Nessus	NewStart CGSL Local Security Checks	high
147257	NewStart CGSL CORE 5.04 / MAIN 5.04 : librepo Vulnerability (NS-SA-2021-0049)	Nessus	NewStart CGSL Local Security Checks	high
147096	EulerOS Virtualization for ARM 64 3.0.6.0 : librepo (EulerOS-SA-2021-1569)	Nessus	Huawei Local Security Checks	high
146510	openSUSE Security Update : librepo (openSUSE-2021-277)	Nessus	SuSE Local Security Checks	high
145940	CentOS 8 : librepo (CESA-2020:3658)	Nessus	CentOS Local Security Checks	high
144434	Virtuozzo 7 : librepo / librepo-devel / python-librepo (VZLSA-2020-5012)	Nessus	Virtuozzo Local Security Checks	high
143580	Amazon Linux 2 : librepo (ALAS-2020-1568)	Nessus	Amazon Linux Local Security Checks	high
143257	EulerOS 2.0 SP8 : librepo (EulerOS-SA-2020-2480)	Nessus	Huawei Local Security Checks	high
143251	Photon OS 3.0: Librepo PHSA-2020-3.0-0164	Nessus	PhotonOS Local Security Checks	high
143047	CentOS 7 : librepo (RHSA-2020:5012)	Nessus	CentOS Local Security Checks	high
142779	Oracle Linux 7 : librepo (ELSA-2020-5012)	Nessus	Oracle Linux Local Security Checks	high
142701	RHEL 7 : librepo (RHSA-2020:5012)	Nessus	Red Hat Local Security Checks	high
142296	EulerOS 2.0 SP9 : librepo (EulerOS-SA-2020-2413)	Nessus	Huawei Local Security Checks	high
142236	EulerOS 2.0 SP9 : librepo (EulerOS-SA-2020-2431)	Nessus	Huawei Local Security Checks	high
141928	Fedora 33 : 1:livecd-tools / createrepo_c / dnf-plugins-core / etc (2020-b40fc174b5)	Nessus	Fedora Local Security Checks	high
141518	Fedora 32 : 1:livecd-tools / createrepo_c / dnf / dnf-plugins-core / etc (2020-5d9f0ce2b3)	Nessus	Fedora Local Security Checks	high
141509	Fedora 31 : librepo (2020-7906a64449)	Nessus	Fedora Local Security Checks	high
140597	RHEL 8 : librepo (RHSA-2020:3756)	Nessus	Red Hat Local Security Checks	high
140594	RHEL 8 : librepo (RHSA-2020:3749)	Nessus	Red Hat Local Security Checks	high
140460	RHEL 8 : librepo (RHSA-2020:3658)	Nessus	Red Hat Local Security Checks	high
140437	Oracle Linux 8 : librepo (ELSA-2020-3658)	Nessus	Oracle Linux Local Security Checks	high
140077	openSUSE Security Update : librepo (openSUSE-2020-1289)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-14352

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high