koji-devel February 2019

koji-devel@lists.stg.fedorahosted.org

3 participants
4 discussions

1.17 in sight
by Michael McLean 22 Feb '19

22 Feb '19

The 1.17 roadmap is cleared and things seem to be working. I've started the PR for the release here: https://pagure.io/koji/pull-request/1275 I'll be working on the release notes and testing. If you're planning on deploying 1.17, now is a good time to test.

1 0

Koji CVE-2018-1002161
by Michael McLean 21 Feb '19

21 Feb '19

CVE-2018-1002161 SQL injection in multiple remote calls Summary This is a critical security bug. Multiple xmlrpc call handlers in Koji’s hub code contain SQL injection bugs. By passing carefully constructed arguments to these calls, an unauthenticated user can issue arbitrary SQL commands to Koji’s database. This gives the attacker broad ability to manipulate or destroy data. There is no known workaround. All Koji admins are encouraged to update to a fixed version as soon as possible. Bug fix We are releasing updates for each affected version of Koji to fix this bug. The following releases <https://pagure.io/koji/releases> all contain the fix: - 1.16.2 - 1.15.2 - 1.14.2 - 1.13.2 - 1.12.2 - 1.11.1 Note: the legacy-py24 branch is unaffected since it is client-only (no hub). For users who have customized their Koji code, we recommend rebasing your work onto the appropriate update release. If this is not feasible, the patch should be very easy to apply. Please see Koji issue 1183 <https://pagure.io/koji/issue/1183> for the code details. As with all changes to hub code, you must restart httpd for the changes to take effect. Links Fixed versions can be found at our releases page: https://pagure.io/koji/releases Questions and answers about this issue https://docs.pagure.org/koji/CVE-2018-1002161-FAQ/

1 0

what's the purpose of callnum?
by Ken Dreyer 19 Feb '19

19 Feb '19

Hi folks, I was reading in the source about callnum and wondering: what is the purpose of callnum? Is it a security feature, or just a way to maintain write operation order? It looks like Koji writes a new callnum integer to the database for every authenticated RPC, even if that RPC is only doing a read-only operation like getBuild. - Ken

2 2

Upcoming CVE-2018-1002161 for Koji
by Michael McLean 19 Feb '19

19 Feb '19

A new CVE for Koji will become public soon. We will announce the details on Thursday, February 21 around 14:00 UTC. The announcement will go to the koji-devel and oss-security mailing lists: https://lists.fedorahosted.org/archives/list/koji-devel@lists.fedorahosted.… http://www.openwall.com/lists/oss-security/

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

koji-devel February 2019