1.17 in sight
by Michael McLean
The 1.17 roadmap is cleared and things seem to be working. I've started the
PR for the release here:
https://pagure.io/koji/pull-request/1275
I'll be working on the release notes and testing. If you're planning on
deploying 1.17, now is a good time to test.
4 years, 3 months
Koji CVE-2018-1002161
by Michael McLean
CVE-2018-1002161
SQL injection in multiple remote calls
Summary
This is a critical security bug.
Multiple xmlrpc call handlers in Koji’s hub code contain SQL injection
bugs. By
passing carefully constructed arguments to these calls, an unauthenticated
user
can issue arbitrary SQL commands to Koji’s database. This gives the attacker
broad ability to manipulate or destroy data.
There is no known workaround. All Koji admins are encouraged to update to a
fixed version as soon as possible.
Bug fix
We are releasing updates for each affected version of Koji to fix this bug.
The following releases <https://pagure.io/koji/releases> all contain the
fix:
-
1.16.2
-
1.15.2
-
1.14.2
-
1.13.2
-
1.12.2
-
1.11.1
Note: the legacy-py24 branch is unaffected since it is client-only (no hub).
For users who have customized their Koji code, we recommend rebasing your
work onto the appropriate update release. If this is not feasible, the
patch should be very easy to apply. Please see Koji issue 1183
<https://pagure.io/koji/issue/1183> for the code details.
As with all changes to hub code, you must restart httpd for the changes to
take effect.
Links
Fixed versions can be found at our releases page:
https://pagure.io/koji/releases
Questions and answers about this issue
https://docs.pagure.org/koji/CVE-2018-1002161-FAQ/
4 years, 3 months
what's the purpose of callnum?
by Ken Dreyer
Hi folks,
I was reading in the source about callnum and wondering: what is the
purpose of callnum?
Is it a security feature, or just a way to maintain write operation order?
It looks like Koji writes a new callnum integer to the database for
every authenticated RPC, even if that RPC is only doing a read-only
operation like getBuild.
- Ken
4 years, 3 months