CVE-2020-14352
📋 TL;DR
CVE-2020-14352 is a directory traversal vulnerability in librepo versions before 1.12.1 that allows attackers controlling remote repositories to write files outside intended directories via unsanitized paths in repository metadata. This could lead to system compromise by overwriting critical files. The primary risk is to users who configure untrusted third-party repositories.
💻 Affected Systems
- librepo
📦 What is this software?
Backports Sle by Opensuse
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Librepo by Redhat
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via overwriting critical system files like /etc/passwd or /etc/shadow, potentially leading to root access.
Likely Case
Arbitrary file write in user-controlled directories, potentially enabling privilege escalation or data corruption.
If Mitigated
No impact if using only trusted repositories and proper access controls.
🎯 Exploit Status
Exploitation requires controlling a repository that the target system trusts and connects to. The vulnerability itself is straightforward path traversal.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.12.1 and later
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=1866498
Restart Required: No
Instructions:
1. Update librepo package using your distribution's package manager. 2. For RHEL/CentOS: 'yum update librepo'. 3. For Fedora: 'dnf update librepo'. 4. For openSUSE: 'zypper update librepo'.
🔧 Temporary Workarounds
Disable untrusted repositories
linuxRemove or disable any untrusted third-party repositories from your system configuration.
# Check configured repositories
yum repolist all
# Disable specific repository
yum-config-manager --disable <repo-id>
Use local repositories only
linuxConfigure system to use only local, verified repositories instead of remote sources.
# Configure local repository in /etc/yum.repos.d/
# Example local repo file with baseurl=file:///path/to/local/repo
🧯 If You Can't Patch
- Only use trusted, verified repositories from official sources
- Implement strict network controls to limit repository connections to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check librepo version: 'rpm -q librepo' or 'librepo --version'. If version is earlier than 1.12.1, system is vulnerable.Check Version:
rpm -q librepo || librepo --version || dnf info librepo | grep VersionVerify Fix Applied:
Verify librepo version is 1.12.1 or later: 'rpm -q librepo | grep 1.12.1' or check with package manager.📡 Detection & Monitoring
Log Indicators:
- Unusual file writes outside expected repository directories
- Failed path traversal attempts in system logs
- Repository metadata fetch errors
Network Indicators:
- Connections to unusual or untrusted repository URLs
- Unexpected file downloads during repository updates
SIEM Query:
source="yum.log" OR source="dnf.log" AND ("path traversal" OR "../" OR directory traversal)🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00072.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00055.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1866498
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33RX4P5R5YL4NZSFSE4NOX37X6YCXAS4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OOMDEQBRJ7SO2QWL7H23G3VV2VSCUYOY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XDMHVY7OMIJNSPVZ2GJWHT77Z5V3YJ55/
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00072.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00055.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1866498
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33RX4P5R5YL4NZSFSE4NOX37X6YCXAS4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OOMDEQBRJ7SO2QWL7H23G3VV2VSCUYOY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XDMHVY7OMIJNSPVZ2GJWHT77Z5V3YJ55/
