CVE-2024-47515: Pagure: generate_archive() follows symbolic links in temporary clones
A vulnerability was found in Pagure. Support of symbolic links during repository archiving of repositories allows the disclosure of local files. This flaw allows a malicious user to take advantage of the Pagure instance.
Other sources
Support of symbolic links during repository archiving of repositories allows the disclosure of local files. This results in the ability to craft valid administrator sessions and take over the Pagure instance.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47515?
CVE-2024-47515 is classified as a medium severity vulnerability.
How does CVE-2024-47515 affect Pagure?
CVE-2024-47515 allows a malicious user to disclose local files through symbolic links during repository archiving.
How do I fix CVE-2024-47515?
To fix CVE-2024-47515, ensure that symbolic links are disabled in the Pagure configuration for repository archiving.
Who is affected by CVE-2024-47515?
Any instance of Pagure that supports symbolic links during repository archiving is potentially affected by CVE-2024-47515.
What actions should be taken if CVE-2024-47515 is exploited?
If CVE-2024-47515 is exploited, immediate steps should include updating Pagure and reviewing access controls to the affected repositories.