CVE-2017-1000001

Advisory

FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

======

This is a security release which addresses CVE-2017-1000001.

Bug fixes
---------

* Fixes an issue in the validation logic of the base consumer which caused
child consumers to not validate the authenticity of messages
(`5c21cf88a <https://github.com/fedora-infra/fedmsg/commit/5c21cf88a>`_).

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000001
• https://github.com/fedora-infra/fedmsg/blob/0.18.2/CHANGELOG.rst