CVE-2024-47515
published 2024-12-24CVE-2024-47515: A vulnerability was found in Pagure. Support of symbolic links during repository archiving of repositories allows the disclosure of local files. This flaw…
high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
A vulnerability was found in Pagure. Support of symbolic links during repository archiving of repositories allows the disclosure of local files. This flaw allows a malicious user to take advantage of the Pagure instance.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pagure | < pagure 5.11.3+dfsg-1+deb11u1 (bullseye) | pagure 5.11.3+dfsg-1+deb11u1 (bullseye) |
| redhat | pagure | >= 0 < 5.11.3+dfsg-1+deb11u1 | 5.11.3+dfsg-1+deb11u1 |
| redhat | pagure | >= 0 < 5.14.1+dfsg-1 | 5.14.1+dfsg-1 |
| redhat | pagure | >= 0 < 5.11.3+dfsg-1ubuntu0.1 | 5.11.3+dfsg-1ubuntu0.1 |
| redhat | pagure | >= 0 < 5.11.3+dfsg-2.1ubuntu0.2 | 5.11.3+dfsg-2.1ubuntu0.2 |
| redhat | pagure | >= 0 < 5.8.1+dfsg-3ubuntu0.1~esm1 | 5.8.1+dfsg-3ubuntu0.1~esm1 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
osv8.1HIGH