{"id":"CVE-2020-14352","aliases":["EUVD-2020-6496","GHSA-2fcv-8cvq-hmxh","MGASA-2020-0429","OESA-2021-1055","RHSA-2020:3658","RHSA-2020:3749","RHSA-2020:3756","RHSA-2020:5012","openSUSE-SU-2020:1289-1","openSUSE-SU-2020:1428-1","openSUSE-SU-2021:0277-1","openSUSE-SU-2021:0295-1","openSUSE-SU-2024:10984-1"],"status":"published","title":"A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was...","description":"A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02526,"percentile":0.84994,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2020-08-30T04:22:38Z","modified":"2026-10-24T10:30:54Z","fixes":[{"ecosystem":"Mageia:7","package":"librepo","fixed_in":["1.10.3-1.1.mga7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS","package":"librepo","fixed_in":["1.12.0-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"librepo","fixed_in":["1.12.0-2.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librepo","fixed_in":["0:1.11.0-3.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librepo-debuginfo","fixed_in":["0:1.11.0-3.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librepo-debugsource","fixed_in":["0:1.11.0-3.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-librepo","fixed_in":["0:1.11.0-3.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-librepo-debuginfo","fixed_in":["0:1.11.0-3.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"librepo","fixed_in":["0:1.10.3-4.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"librepo-debuginfo","fixed_in":["0:1.10.3-4.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"librepo-debugsource","fixed_in":["0:1.10.3-4.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"python3-librepo","fixed_in":["0:1.10.3-4.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"python3-librepo-debuginfo","fixed_in":["0:1.10.3-4.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"librepo","fixed_in":["0:1.9.2-2.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"librepo-debuginfo","fixed_in":["0:1.9.2-2.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"librepo-debugsource","fixed_in":["0:1.9.2-2.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"python3-librepo","fixed_in":["0:1.9.2-2.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"python3-librepo-debuginfo","fixed_in":["0:1.9.2-2.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"librepo","fixed_in":["0:1.8.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"librepo-debuginfo","fixed_in":["0:1.8.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"librepo-devel","fixed_in":["0:1.8.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-librepo","fixed_in":["0:1.8.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"librepo","fixed_in":["0:1.8.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"librepo-debuginfo","fixed_in":["0:1.8.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"librepo-devel","fixed_in":["0:1.8.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-librepo","fixed_in":["0:1.8.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"librepo","fixed_in":["0:1.8.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"librepo-debuginfo","fixed_in":["0:1.8.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"librepo-devel","fixed_in":["0:1.8.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-librepo","fixed_in":["0:1.8.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"librepo","fixed_in":["0:1.8.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"librepo-debuginfo","fixed_in":["0:1.8.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"librepo-devel","fixed_in":["0:1.8.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-librepo","fixed_in":["0:1.8.1-8.el7_9"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"librepo","fixed_in":["1.11.2-lp152.2.3.1","1.12.1-lp152.2.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"librepo","fixed_in":["1.11.2-bp152.2.3.1","1.12.1-bp152.2.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:7","package":"librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-1.1.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-2.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-3.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librepo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-3.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librepo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-3.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-3.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-librepo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-3.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.3-4.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"librepo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.3-4.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"librepo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.3-4.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"python3-librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.3-4.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"python3-librepo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.3-4.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2-2.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"librepo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2-2.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"librepo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2-2.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"python3-librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2-2.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"python3-librepo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2-2.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"librepo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"librepo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"python-librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"librepo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"librepo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"python-librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"librepo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"librepo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"python-librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"librepo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"librepo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"python-librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-8.el7_9"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.2-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.2-bp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-lp152.2.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-bp152.2.6.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"microsoft","product":"librepo"},{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap"},{"vendor":"redhat","product":"librepo"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1866498","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00072.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00055.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OOMDEQBRJ7SO2QWL7H23G3VV2VSCUYOY/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33RX4P5R5YL4NZSFSE4NOX37X6YCXAS4/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XDMHVY7OMIJNSPVZ2GJWHT77Z5V3YJ55/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14352","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33RX4P5R5YL4NZSFSE4NOX37X6YCXAS4/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OOMDEQBRJ7SO2QWL7H23G3VV2VSCUYOY/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XDMHVY7OMIJNSPVZ2GJWHT77Z5V3YJ55/"},{"url":"https://github.com/advisories/GHSA-2fcv-8cvq-hmxh"},{"url":"https://advisories.mageia.org/MGASA-2020-0429.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27241","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/33RX4P5R5YL4NZSFSE4NOX37X6YCXAS4/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5012","tags":["web","advisory"]},{"url":"https://lists.opensuse.org/opensuse-security-announce/2020-08/msg00072.html","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1055","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3658","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3658.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14352","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14352","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3749","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3749.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3756","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3756.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5012.json","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2DH6WGXDJ45VIW5OBGKBLRE3HPNE3IPY/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1175475","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14352","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G7GZALJI63DQK5OFRITVFDO6O6KP72ST/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GMUBDUMWN7YJEDAXCHHKHS3ODSQ7RUOF/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GYLQMSF6PIISUQS6BSMK2ASAHIX4PTL5/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-14352","description":"A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.","status":"published","published":"2020-08-30T13:55:27Z","modified":"2024-08-04T12:39:36.596Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:46.873079Z"}],"euvd":[{"id":"EUVD-2020-6496","description":"A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.","status":"published","published":"2020-08-30T13:55:27Z","modified":"2024-08-04T12:39:36Z","updated_at":"2026-11-03T03:07:34.636169Z"}],"ghsa":[{"id":"GHSA-2fcv-8cvq-hmxh","title":"A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was...","description":"A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.","status":"published","published":"2022-05-24T17:26:56Z","modified":"2023-01-29T05:03:54Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:45:25.585599Z"}],"nvd":[{"id":"CVE-2020-14352","description":"A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.","status":"published","published":"2020-08-30T15:15:12.043Z","modified":"2026-06-17T02:54:36.6Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":8.5,"vector":"AV:N/AC:M/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:13.600965Z"}],"osv":[{"id":"CVE-2020-14352","description":"A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.","status":"published","published":"2020-08-30T15:15:12.043Z","modified":"2026-10-24T10:30:54.078385896Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"OESA-2021-1055","title":"librepo security update","description":"A library providing C and Python (libcURL like) API to downloading repository metadata.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.(CVE-2020-14352)","status":"published","published":"2021-03-05T11:04:17Z","modified":"2026-08-18T01:15:16.884326483Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2020:3658","title":"Red Hat Security Advisory: librepo security update","status":"published","published":"2024-09-16T04:42:23Z","modified":"2025-11-22T12:07:29Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:3749","title":"Red Hat Security Advisory: librepo security update","status":"published","published":"2024-09-16T04:42:30Z","modified":"2025-11-22T12:07:52Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:3756","title":"Red Hat Security Advisory: librepo security update","status":"published","published":"2024-09-16T04:42:37Z","modified":"2025-11-22T12:07:55Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:5012","title":"Red Hat Security Advisory: librepo security update","status":"published","published":"2024-09-16T04:42:44Z","modified":"2026-06-26T10:51:48Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"MGASA-2020-0429","title":"Updated librepo packages fix a security vulnerability","description":"It was discovered that librepo was subject to a directory traversal vulnerability\nwhere it failed to sanitize paths in remote repository metadata. An attacker\ncontrolling a remote repository may be able to copy files outside of the\ndestination directory on the targeted system via path traversal. This flaw\ncould potentially result in system compromise via the overwriting of critical\nsystem files (CVE-2020-14352).\n","status":"published","published":"2020-11-21T12:21:00Z","modified":"2026-04-16T04:44:39.238872868Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:1289-1","title":"Security update for librepo","description":"This update for librepo fixes the following issues:\n\n- Fixed path validation to prevent directory traversal attacks (bsc#1175475, CVE-2020-14352)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-08-30T04:22:38Z","modified":"2026-02-04T03:18:00.769796Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1428-1","title":"Security update for librepo","description":"This update for librepo fixes the following issues:\n\n- Fixed path validation to prevent directory traversal attacks (bsc#1175475, CVE-2020-14352)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2020-09-14T18:22:45Z","modified":"2025-05-07T18:11:32.287135Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2021:0277-1","title":"Security update for librepo","description":"This update for librepo fixes the following issues:\n\n- Upgrade to 1.12.1\n  + Validate path read from repomd.xml (bsc#1175475, CVE-2020-14352)\n- Changes from 1.12.0\n  + Prefer mirrorlist/metalink over baseurl (rh#1775184)\n  + Decode package URL when using for local filename (rh#1817130)\n  + Fix memory leak in lr_download_metadata() and lr_yum_download_remote()\n  + Download sources work when at least one of specified is working (rh#1775184)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-02-12T00:12:25Z","modified":"2026-02-04T02:22:03.824383Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0295-1","title":"Security update for librepo","description":"This update for librepo fixes the following issues:\n\n- Upgrade to 1.12.1\n  + Validate path read from repomd.xml (bsc#1175475, CVE-2020-14352)\n- Changes from 1.12.0\n  + Prefer mirrorlist/metalink over baseurl (rh#1775184)\n  + Decode package URL when using for local filename (rh#1817130)\n  + Fix memory leak in lr_download_metadata() and lr_yum_download_remote()\n  + Download sources work when at least one of specified is working (rh#1775184)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-02-15T11:04:32Z","modified":"2026-02-04T03:53:26.332256Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10984-1","title":"librepo-devel-1.14.2-1.2 on GA media","description":"These are all security issues fixed in the librepo-devel-1.14.2-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:57:50.811131Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}