Debian 11: Pagure Critical Issues DLA-4390-1 CVE-2024-4981 CVE-2024-4982

Multiple vulnerabilities have been discovered in Pagure, a Git-centered
code hosting system (forge).


CVE-2024-4981

The function _update_file_in_git() follows symbolic links in
temporary clones. The fix is to bail out if a file path is outside
the temp repo or inside the '.git/' folder to avoid data leak and
unauthorized changes in files or git config.

CVE-2024-4982

Path traversal in view_issue_raw_file().

CVE-2024-47515

The generate_archive() function follows symbolic links in temporary
clones. The fix is to the add actual link rather than the target
content to the zip archive.

CVE-2024-47516

Fix an injection of additional options to the Git command-line
during retrieval of the repository history to prevent remote code
execution.


For Debian 11 bullseye, these problems have been fixed in version
5.11.3+dfsg-1+deb11u1.

We recommend that you upgrade your pagure packages.

For the detailed security status of pagure please refer to
its security tracker page at: