CVE-2020-14352
A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was...
A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.
- Record
CVE-2020-14352- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 8.5 High
AV:N/AC:M/Au:S/C:C/I:C/A:C - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.
- Record
CVE-2020-14352- Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2020-6496 No score
A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.
- Record
EUVD-2020-6496- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2fcv-8cvq-hmxh No score
A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was...
A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.
- Record
GHSA-2fcv-8cvq-hmxh- Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.
- Record
CVE-2020-14352- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2021-1055
librepo security update
A library providing C and Python (libcURL like) API to downloading repository metadata.
Security Fix(es):
A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.(CVE-2020-14352)
- Record
OESA-2021-1055- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVRHSA-2020:3658
Red Hat Security Advisory: librepo security update
- Record
RHSA-2020:3658- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3749
Red Hat Security Advisory: librepo security update
- Record
RHSA-2020:3749- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3756
Red Hat Security Advisory: librepo security update
- Record
RHSA-2020:3756- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:5012
Red Hat Security Advisory: librepo security update
- Record
RHSA-2020:5012- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2020-0429 No score
Updated librepo packages fix a security vulnerability
It was discovered that librepo was subject to a directory traversal vulnerability where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files (CVE-2020-14352).
- Record
MGASA-2020-0429- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1289-1 No score
Security update for librepo
This update for librepo fixes the following issues:
- Fixed path validation to prevent directory traversal attacks (bsc#1175475, CVE-2020-14352)
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2020:1289-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1428-1 No score
Security update for librepo
This update for librepo fixes the following issues:
- Fixed path validation to prevent directory traversal attacks (bsc#1175475, CVE-2020-14352)
This update was imported from the SUSE:SLE-15-SP2:Update update project. This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2020:1428-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0277-1 No score
Security update for librepo
This update for librepo fixes the following issues:
- Upgrade to 1.12.1
- Validate path read from repomd.xml (bsc#1175475, CVE-2020-14352)
- Changes from 1.12.0
- Prefer mirrorlist/metalink over baseurl (rh#1775184)
- Decode package URL when using for local filename (rh#1817130)
- Fix memory leak in lr_download_metadata() and lr_yum_download_remote()
- Download sources work when at least one of specified is working (rh#1775184)
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2021:0277-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0295-1 No score
Security update for librepo
This update for librepo fixes the following issues:
- Upgrade to 1.12.1
- Validate path read from repomd.xml (bsc#1175475, CVE-2020-14352)
- Changes from 1.12.0
- Prefer mirrorlist/metalink over baseurl (rh#1775184)
- Decode package URL when using for local filename (rh#1817130)
- Fix memory leak in lr_download_metadata() and lr_yum_download_remote()
- Download sources work when at least one of specified is working (rh#1775184)
This update was imported from the SUSE:SLE-15-SP2:Update update project. This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2021:0295-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10984-1 No score
librepo-devel-1.14.2-1.2 on GA media
These are all security issues fixed in the librepo-devel-1.14.2-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10984-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
librepoMageia:7 |
before 1.10.3-1.1.mga7 | 1.10.3-1.1.mga7 |
librepoopenEuler:20.03-LTS |
before 1.12.0-2.oe1 | 1.12.0-2.oe1 |
librepoopenEuler:20.03-LTS-SP1 |
before 1.12.0-2.oe1 | 1.12.0-2.oe1 |
librepoRed Hat:enterprise_linux:8::baseos |
before 0:1.11.0-3.el8_2 | 0:1.11.0-3.el8_2 |
librepo-debuginfoRed Hat:enterprise_linux:8::baseos |
before 0:1.11.0-3.el8_2 | 0:1.11.0-3.el8_2 |
librepo-debugsourceRed Hat:enterprise_linux:8::baseos |
before 0:1.11.0-3.el8_2 | 0:1.11.0-3.el8_2 |
python3-librepoRed Hat:enterprise_linux:8::baseos |
before 0:1.11.0-3.el8_2 | 0:1.11.0-3.el8_2 |
python3-librepo-debuginfoRed Hat:enterprise_linux:8::baseos |
before 0:1.11.0-3.el8_2 | 0:1.11.0-3.el8_2 |
librepoRed Hat:rhel_eus:8.1::baseos |
before 0:1.10.3-4.el8_1 | 0:1.10.3-4.el8_1 |
librepo-debuginfoRed Hat:rhel_eus:8.1::baseos |
before 0:1.10.3-4.el8_1 | 0:1.10.3-4.el8_1 |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
librepo-debugsourceRed Hat:rhel_eus:8.1::baseos |
before 0:1.10.3-4.el8_1 | 0:1.10.3-4.el8_1 |
python3-librepoRed Hat:rhel_eus:8.1::baseos |
before 0:1.10.3-4.el8_1 | 0:1.10.3-4.el8_1 |
python3-librepo-debuginfoRed Hat:rhel_eus:8.1::baseos |
before 0:1.10.3-4.el8_1 | 0:1.10.3-4.el8_1 |
librepoRed Hat:rhel_e4s:8.0::baseos |
before 0:1.9.2-2.el8_0 | 0:1.9.2-2.el8_0 |
librepo-debuginfoRed Hat:rhel_e4s:8.0::baseos |
before 0:1.9.2-2.el8_0 | 0:1.9.2-2.el8_0 |
librepo-debugsourceRed Hat:rhel_e4s:8.0::baseos |
before 0:1.9.2-2.el8_0 | 0:1.9.2-2.el8_0 |
python3-librepoRed Hat:rhel_e4s:8.0::baseos |
before 0:1.9.2-2.el8_0 | 0:1.9.2-2.el8_0 |
python3-librepo-debuginfoRed Hat:rhel_e4s:8.0::baseos |
before 0:1.9.2-2.el8_0 | 0:1.9.2-2.el8_0 |
librepoRed Hat:enterprise_linux:7::client |
before 0:1.8.1-8.el7_9 | 0:1.8.1-8.el7_9 |
librepo-debuginfoRed Hat:enterprise_linux:7::client |
before 0:1.8.1-8.el7_9 | 0:1.8.1-8.el7_9 |
librepo-develRed Hat:enterprise_linux:7::client |
before 0:1.8.1-8.el7_9 | 0:1.8.1-8.el7_9 |
python-librepoRed Hat:enterprise_linux:7::client |
before 0:1.8.1-8.el7_9 | 0:1.8.1-8.el7_9 |
librepoRed Hat:enterprise_linux:7::computenode |
before 0:1.8.1-8.el7_9 | 0:1.8.1-8.el7_9 |
librepo-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:1.8.1-8.el7_9 | 0:1.8.1-8.el7_9 |
librepo-develRed Hat:enterprise_linux:7::computenode |
before 0:1.8.1-8.el7_9 | 0:1.8.1-8.el7_9 |
python-librepoRed Hat:enterprise_linux:7::computenode |
before 0:1.8.1-8.el7_9 | 0:1.8.1-8.el7_9 |
librepoRed Hat:enterprise_linux:7::server |
before 0:1.8.1-8.el7_9 | 0:1.8.1-8.el7_9 |
librepo-debuginfoRed Hat:enterprise_linux:7::server |
before 0:1.8.1-8.el7_9 | 0:1.8.1-8.el7_9 |
librepo-develRed Hat:enterprise_linux:7::server |
before 0:1.8.1-8.el7_9 | 0:1.8.1-8.el7_9 |
python-librepoRed Hat:enterprise_linux:7::server |
before 0:1.8.1-8.el7_9 | 0:1.8.1-8.el7_9 |
librepoRed Hat:enterprise_linux:7::workstation |
before 0:1.8.1-8.el7_9 | 0:1.8.1-8.el7_9 |
librepo-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:1.8.1-8.el7_9 | 0:1.8.1-8.el7_9 |
librepo-develRed Hat:enterprise_linux:7::workstation |
before 0:1.8.1-8.el7_9 | 0:1.8.1-8.el7_9 |
python-librepoRed Hat:enterprise_linux:7::workstation |
before 0:1.8.1-8.el7_9 | 0:1.8.1-8.el7_9 |
librepoopenSUSE:Leap 15.2 |
before 1.11.2-lp152.2.3.1 | 1.11.2-lp152.2.3.1 |
librepoSUSE:Package Hub 15 SP2 |
before 1.11.2-bp152.2.3.1 | 1.11.2-bp152.2.3.1 |
librepoopenSUSE:Leap 15.2 |
before 1.12.1-lp152.2.6.1 | 1.12.1-lp152.2.6.1 |
librepoSUSE:Package Hub 15 SP2 |
before 1.12.1-bp152.2.6.1 | 1.12.1-bp152.2.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-14352 is a high vulnerability (CVSS 8.0) in Microsoft Librepo, published August 30, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.53%, the 84th percentile. Fixed in librepo 1.10.3-1.1.mga7.
References
bugzilla.redhat.com/show_bug.cgi?id=1866498
lists.opensuse.org/opensuse-security-announce/2020-08/msg00072.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OOMDEQBRJ7SO2QWL7H23G3VV2VSCUYOY
Show 26 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-14352
github.com/advisories/GHSA-2fcv-8cvq-hmxh
advisories.mageia.org/MGASA-2020-0429.html
bugs.mageia.org/show_bug.cgi?id=27241
access.redhat.com/errata/RHSA-2020:5012
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1055
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3658.json
cve.org/CVERecord?id=CVE-2020-14352
bugzilla.suse.com/1175475
suse.com/security/cve/CVE-2020-14352