CVE catalog

CVE-2020-14352

Security update for librepo

[CVE catalog]

Severity
High · CVSS 8CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
2.53% · Oct 25, 2026

This update for librepo fixes the following issues: - Upgrade to 1.12.1 + Validate path read from repomd.xml (bsc#1175475, CVE-2020-14352) - Changes from 1.12.0 + Prefer mirrorlist/metalink over baseurl (rh#1775184) + Decode package URL when using for local filename (rh#1817130) + Fix memory leak in lr_download_metadata() and lr_yum_download_remote() + Download sources work when at least one of specified is working (rh#1775184) This update was imported from the SUSE:SLE-15-SP2:Update update project. This update was imported from the openSUSE:Leap:15.2:Update update project.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Suselibrepopackage hub 15 sp21.12.1-bp152.2.6.1fixed
Opensuselibrepoleap 15.21.11.2-lp152.2.3.1fixed
Opensuselibrepoleap 15.21.12.1-lp152.2.6.1fixed
Suselibrepopackage hub 15 sp21.11.2-bp152.2.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Suselibreporpmpackage hub 15 sp21.12.1-bp152.2.6.1Not reportedOPENSUSE-SU-2021:0295-1Not reported
Opensuselibreporpmleap 15.21.11.2-lp152.2.3.1Not reportedOPENSUSE-SU-2020:1289-1Not reported
Opensuselibreporpmleap 15.21.12.1-lp152.2.6.1Not reportedOPENSUSE-SU-2021:0277-1Not reported
Suselibreporpmpackage hub 15 sp21.11.2-bp152.2.3.1Not reportedOPENSUSE-SU-2020:1428-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]