VA-25-021-01

Vulnerability from csaf_cisa - Published: 2025-01-23 00:00 - Updated: 2025-01-23 00:00
Summary
Fedora Repository fedoraIntCallUser default credentials and insecure archive extraction

Notes

Risk Evaluation
Fedora Repository 3.8 includes default user credentials and allows path traversal when extracting uploaded archive files. An attacker can exploit these vulnerabilities to read sensitive data and execute arbitrary commands with the privileges of the Java web application server. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained.
Legal Notice
All information products included in https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Countries and Areas Deployed
Worldwide
Recommended Practices
Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. No remediation will be provided for these vulnerabilities. [Migrate](https://github.com/fcrepo-exts/migration-utils) to a currently supported version (6.5.1 as of 2025-01-23).
Company Headquarters Location
United States
Critical Infrastructure Sectors
Information Technology
To clipboard 

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "Fedora Repository 3.8 includes default user credentials and allows path traversal when extracting uploaded archive files. An attacker can exploit these vulnerabilities to read sensitive data and execute arbitrary commands with the privileges of the Java web application server. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained.\n",
        "title": "Risk Evaluation"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries and Areas Deployed"
      },
      {
        "category": "general",
        "text": "Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. No remediation will be provided for these vulnerabilities. [Migrate](https://github.com/fcrepo-exts/migration-utils) to a currently supported version (6.5.1 as of 2025-01-23).",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company Headquarters Location"
      },
      {
        "category": "description",
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Vulnerability Advisory VA-25-021-01 CSAF",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-021-01.json"
      }
    ],
    "title": "Fedora Repository fedoraIntCallUser default credentials and insecure archive extraction",
    "tracking": {
      "current_release_date": "2025-01-23T00:00:00Z",
      "generator": {
        "date": "2025-01-23T20:08:19Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.17"
        }
      },
      "id": "VA-25-021-01",
      "initial_release_date": "2025-01-23T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-01-23T00:00:00Z",
          "number": "1.0.0",
          "summary": "Initial publication"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=3.8.1",
                "product": {
                  "name": "Fedora Repository Fedora Repository 0 \u003c= 3.8.1",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "Fedora Repository"
          }
        ],
        "category": "vendor",
        "name": "Fedora Repository"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Matthew Galligan"
          ],
          "organization": "CISA"
        }
      ],
      "cve": "CVE-2025-23011",
      "cwe": {
        "id": "CWE-23",
        "name": "Relative Path Traversal"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Fedora Repository 3.8.x allows path traversal when extracting uploaded archives (\"Zip Slip\"). A remote, authenticated attacker can upload a specially crafted archive that will extract an arbitrary JSP file to a location that can be executed by an unauthenticated GET request. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23).",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:P/A:N/T:T/2025-01-08T16:16:12Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-021-01.json"
        },
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/fcrepo-exts/migration-utils"
        },
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/fcrepo/fcrepo/releases"
        }
      ],
      "release_date": "2025-01-23T00:00:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. No remediation will be provided for these vulnerabilities. [Migrate](https://github.com/fcrepo-exts/migration-utils) to a currently supported version (6.5.1 as of 2025-01-23).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://github.com/fcrepo-exts/migration-utils"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "Fedora Repository archive extraction path traversal"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Matthew Galligan"
          ],
          "organization": "CISA"
        }
      ],
      "cve": "CVE-2025-23012",
      "cwe": {
        "id": "CWE-1392",
        "name": "Use of Default Credentials"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastreams. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23).",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:P/A:Y/T:P/2025-01-23T19:26:24Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-021-01.json"
        },
        {
          "category": "external",
          "summary": "wiki.lyrasis.org",
          "url": "https://wiki.lyrasis.org/display/FEDORA38/XACML+Policy+Enforcement#XACMLPolicyEnforcement-4.1fedora-usersattributes"
        },
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/fcrepo-exts/migration-utils"
        },
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/fcrepo/fcrepo/releases"
        }
      ],
      "release_date": "2025-01-23T00:00:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. No remediation will be provided for these vulnerabilities. [Migrate](https://github.com/fcrepo-exts/migration-utils) to a currently supported version (6.5.1 as of 2025-01-23).",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://github.com/fcrepo-exts/migration-utils"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "Fedora Repository fedoraIntCallUser default credentials"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.