Bug 1870789 (CVE-2020-24614)

Summary:	CVE-2020-24614 fossil: allows remote authenticated users to execute arbitrary code
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	divya.hariomtatsat, petasisg
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-08-20 21:15:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1870790
Bug Blocks:

Description Guilherme de Almeida Suckevicz 2020-08-20 18:15:27 UTC

"Researcher Max Justicz discovered a potential RCE and other
vulnerabilities in the Fossil distributed version control system.
(https://fossil-scm.org/)  Patches to address these issues are now
available for download.  Package maintainers who bundle Fossil are
encouraged to update their packages without unnecessary delay.

All vulnerabilities require a pre-existing trust relationship between
the victim and the attacker.  In other words, the attacker must be
either a site administrator, or someone with check-in privileges on
the project.  There are no known vulnerabilities to servers from web
users entering tickets or forum messages or wiki or doing other
on-line operations.  The attacks require the ability to push, at
least, and the most serious RCE problem requires the ability to
configure a server in malicious ways.  If you are unable to upgrade to
one of the patched versions of Fossil, then you are encouraged at
least to know well the people from whom you clone or pull.

Precompiled binaries and source tarballs for the patched versions of
Fossil are available on the Fossil download page
(http://fossil-scm.org/fossil/uv/download.html).  However, the dozens
of check-ins that went into generating these patches, and the tickets
that describe the specifics of the vulnerabilities, will be embargoed
for a few days.

See the thread on the Fossil Forum
(https://fossil-scm.org/forum/info/a05ae3ce7760daf6) for follow up
information or to communicate directly with the Fossil developers."

Comment 1 Guilherme de Almeida Suckevicz 2020-08-20 18:15:41 UTC

Created fossil tracking bugs for this issue:

Affects: fedora-all [bug 1870790]

Comment 2 Product Security DevOps Team 2020-08-20 21:15:15 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.

Comment 3 Guilherme de Almeida Suckevicz 2020-08-25 17:34:05 UTC

Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbitrary code. An attacker must have check-in privileges on the repository.

References:
https://fossil-scm.org/forum/info/a05ae3ce7760daf6
https://www.openwall.com/lists/oss-security/2020/08/20/1