{"id":122827,"date":"2025-03-25T04:22:52","date_gmt":"2025-03-25T02:22:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse"},"modified":"2025-03-25T04:22:52","modified_gmt":"2025-03-25T02:22:52","slug":"uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-v-pagure-i-obs-dopuskavshie-komprometacziyu-paketov-v-repozitoriyah-fedora-i-opensuse","title":{"rendered":"Vulnerabilities in Pagure and OBS allowed for the compromise of packages in Fedora and openSUSE repositories","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Security researchers from Fenrisk revealed vulnerabilities in the Pagure and OBS (Open Build Service) tools that could compromise the package building infrastructures of Fedora and openSUSE. The researchers demonstrated the possibility of executing an attack to run arbitrary code on servers using Pagure and OBS, which could be exploited to modify packages in the Fedora and openSUSE repositories. <\/p>\n

The Pagure platform, used in Fedora for collaborative work with code and package metadata, has revealed 4 vulnerabilities. Exploiting these issues requires a Pagure account, which anyone can obtain (currently, there are 24,899 registered users on Pagure.io). Three of the issues allow reading files on the system, while one problem allows executing custom code on serwerze<\/a>. The issues were identified on January 1, 2024, reported through bugzilla.redhat.com on April 25, 2024, and fixed in Pagure within 3 hours. <\/p>\n