Security update for obs-service-tar_scm (important)

🗓️ 15 Mar 2019 00:00:00Reported by OpenSuseType

Security update for obs-service-tar_scm with fixes for three vulnerabilities and two other issues including improved handling of corrupt git cache directories and http proxy suppor

Reporter	Title	Published	Views	Family All 33
BDU FSTEC	The vulnerability of the Open Build Service software platform, related to incorrect restrictions on the path to the restricted catalog, allows a perpetrator to gain unauthorized access to protected information.	16 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the obs-service-tar_scm service of the Open Build Service software platform allows a perpetrator to gain unauthorized access to protected information or execute arbitrary code.	16 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the code packaging service in tar-archives, obs-service-tar_scm, allows a perpetrator to gain unauthorized access to protected information or execute arbitrary code.	16 Apr 202000:00	–	bdu_fstec
Circl	CVE-2018-12476	27 Jan 202012:37	–	circl
CNVD	Open Build Service Input Validation Vulnerability	30 Oct 201800:00	–	cnvd
CVE	CVE-2018-12473	2 Oct 201815:00	–	cve
CVE	CVE-2018-12474	9 Oct 201813:00	–	cve
CVE	CVE-2018-12476	27 Jan 202008:30	–	cve
Cvelist	CVE-2018-12473 path traversal in obs-service-tar_scm	2 Oct 201815:00	–	cvelist
Cvelist	CVE-2018-12474 Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm	9 Oct 201813:00	–	cvelist

OS	OS Version	Architecture	Package	Package Version	Filename
opensuse backports	15	noarch	obs-service-appimage-0.10.5.1551309990.79898c7-bp150.3.3.1.noarch.rpm	0.10.5.1551309990.79898c7	obs-service-appimage
opensuse backports	15	noarch	obs-service-obs_scm-0.10.5.1551309990.79898c7-bp150.3.3.1.noarch.rpm	0.10.5.1551309990.79898c7	obs-service-obs_scm
opensuse backports	15	noarch	obs-service-obs_scm-common-0.10.5.1551309990.79898c7-bp150.3.3.1.noarch.rpm	0.10.5.1551309990.79898c7	obs-service-obs_scm-common
opensuse backports	15	noarch	obs-service-snapcraft-0.10.5.1551309990.79898c7-bp150.3.3.1.noarch.rpm	0.10.5.1551309990.79898c7	obs-service-snapcraft
opensuse backports	15	noarch	obs-service-tar-0.10.5.1551309990.79898c7-bp150.3.3.1.noarch.rpm	0.10.5.1551309990.79898c7	obs-service-tar
opensuse backports	15	noarch	obs-service-tar_scm-0.10.5.1551309990.79898c7-bp150.3.3.1.noarch.rpm	0.10.5.1551309990.79898c7	obs-service-tar_scm

15 Mar 2019 00:00Current

7.5High risk

Vulners AI Score7.5

CVSS 27.5

CVSS 35.4 - 9.8

CVSS 3.14.3 - 7.5

EPSS0.01817