author
Thomas Chauchefoin
Thomas Chauchefoin (@swapgs@infosec.exchange) is a Principal Application Security Engineer at Bentley Systems. With a strong background in offensive security, he helps uncover and responsibly disclose 0-days in major open-source software. He also participated in competitions like Pwn2Own or Hack-a-Sat and was nominated for two Pwnies Awards for his research on PHP supply chain security.
0day - RCE - Fedora Pagure - CVE-2024-47516
Supply Chain Attacks on Linux distributions - Fedora Pagure
As discussed in the meta-article, we picked Pagure from the Fedora Apps Directory and already had a technical approach in mind. A software forge is likely to be a good target for an argument injection: we can expect the…
CVSS 9.8