rpm package
opensuse/osc&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/osc&distro=openSUSE%20Tumbleweed
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-22034 | Med | 5.5 | < 1.9.0-1.1 | 1.9.0-1.1 | Oct 16, 2024 | Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim | |
| CVE-2019-3681 | — | < 0.174.0-1.2 | 0.174.0-1.2 | Jun 29, 2020 | A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote | ||
| CVE-2019-3685 | — | < 0.174.0-1.2 | 0.174.0-1.2 | Nov 5, 2019 | Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary | ||
| CVE-2015-0778 | — | < 0.155.1-2.1 | 0.155.1-2.1 | Mar 16, 2015 | osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file. | ||
| CVE-2012-1095 | — | < 0.155.1-2.1 | 0.155.1-2.1 | Feb 6, 2014 | osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log or (2) build status that contains an escape sequence for a terminal emulator. |
- affected < 1.9.0-1.1fixed 1.9.0-1.1
Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim
- CVE-2019-3681Jun 29, 2020affected < 0.174.0-1.2fixed 0.174.0-1.2
A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote
- CVE-2019-3685Nov 5, 2019affected < 0.174.0-1.2fixed 0.174.0-1.2
Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary
- CVE-2015-0778Mar 16, 2015affected < 0.155.1-2.1fixed 0.155.1-2.1
osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.
- CVE-2012-1095Feb 6, 2014affected < 0.155.1-2.1fixed 0.155.1-2.1
osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log or (2) build status that contains an escape sequence for a terminal emulator.