CVE-2024-4981
published 2025-05-12CVE-2024-4981: A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show…
high7.1CVSS 3.1
AVNACLPRLUINSUCHILAN
A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show incorporate and make visible content from outside the git repo.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pagure | < pagure 5.11.3+dfsg-1+deb11u1 (bullseye) | pagure 5.11.3+dfsg-1+deb11u1 (bullseye) |
| redhat | pagure | < 5.14.1 | 5.14.1 |
| redhat | pagure | >= 0 < 5.11.3+dfsg-1+deb11u1 | 5.11.3+dfsg-1+deb11u1 |
| redhat | pagure | >= 0 < 5.14.1+dfsg-1 | 5.14.1+dfsg-1 |
| redhat | pagure | >= 0 < 5.11.3+dfsg-1ubuntu0.1 | 5.11.3+dfsg-1ubuntu0.1 |
| redhat | pagure | >= 0 < 5.11.3+dfsg-2.1ubuntu0.2 | 5.11.3+dfsg-2.1ubuntu0.2 |
| redhat | pagure | >= 0 < 5.8.1+dfsg-3ubuntu0.1~esm1 | 5.8.1+dfsg-3ubuntu0.1~esm1 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
osv8.1HIGH