Today we have released security updates for Koji to address CVE-2024-9427, an xss vulnerability in the Koji web ui. These updates cover Koji releases from the past year. They are:
1.35.1 1.34.3 1.33.2
You can download these and other releases at https://pagure.io/koji/releases
While we do not believe that this vulnerability can be used to submit an action or make a change in Koji, it is still a serious issue and we recommend applying this update promptly.
For further information see: https://docs.pagure.org/koji/CVEs/CVE-2024-9427/ https://pagure.io/koji/issue/4204
Many thanks to all those that helped find and address this issue!
koji-devel@lists.fedorahosted.org