DATABASE RESOURCES PRICING ABOUT US

{"id": "OPENVAS:1361412562310853224", "type": "openvas", "bulletinFamily": "scanner", "title": "openSUSE: Security Advisory for osc (openSUSE-SU-2020:0852-1)", "description": "The remote host is missing an update for the ", "published": "2020-06-23T00:00:00", "modified": "2020-07-14T00:00:00", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310853224", "reporter": "Copyright (C) 2020 Greenbone Networks GmbH", "references": ["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00046.html", "2020:0852-1"], "cvelist": ["CVE-2019-3681"], "lastseen": "2020-07-21T19:32:57", "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2019-3681"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2019-3681"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/SUSE-CVE-2019-3681/"]}, {"type": "nessus", "idList": ["OPENSUSE-2020-852.NASL"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2020:0852-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2019-3681"]}], "rev": 4}, "score": {"value": 5.5, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2019-3681"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2019-3681"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/SUSE-CVE-2019-3681/"]}, {"type": "nessus", "idList": ["OPENSUSE-2020-852.NASL"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2020:0852-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2019-3681"]}]}, "exploitation": null, "vulnersScore": 5.5}, "pluginID": "1361412562310853224", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.853224\");\n script_version(\"2020-07-14T13:08:55+0000\");\n script_cve_id(\"CVE-2019-3681\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-07-14 13:08:55 +0000 (Tue, 14 Jul 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-06-23 03:00:56 +0000 (Tue, 23 Jun 2020)\");\n script_name(\"openSUSE: Security Advisory for osc (openSUSE-SU-2020:0852-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap15\\.1\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2020:0852-1\");\n script_xref(name:\"URL\", value:\"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00046.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'osc'\n package(s) announced via the openSUSE-SU-2020:0852-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for osc to 0.169.1 fixes the following issues:\n\n Security issue fixed:\n\n - CVE-2019-3681: Fixed an insufficient validation of network-controlled\n filesystem paths (bsc#1122675).\n\n Non-security issues fixed:\n\n - Improved the speed and usability of osc bash completion.\n\n - improved some error messages.\n\n - osc add: support git@ (private github) or git:// URLs correctly.\n\n - Split dependson and whatdependson commands.\n\n - Added support for osc build --shell-cmd.\n\n - Added pkg-ccache support for osc build.\n\n - Added --ccache option to osc getbinaries\n\n This update was imported from the SUSE:SLE-15-SP1:Update update project.\n\n\n Patch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended\n installation methods\n like YaST online_update or 'zypper patch'.\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.1:\n\n zypper in -t patch openSUSE-2020-852=1\");\n\n script_tag(name:\"affected\", value:\"'osc' package(s) on openSUSE Leap 15.1.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap15.1\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"osc\", rpm:\"osc~0.169.1~lp151.2.15.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "naslFamily": "SuSE Local Security Checks", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645755516}}

{"nessus": [{"lastseen": "2022-02-19T12:29:27", "description": "This update for osc to 0.169.1 fixes the following issues :\n\nSecurity issue fixed :\n\n - CVE-2019-3681: Fixed an insufficient validation of network-controlled filesystem paths (bsc#1122675).\n\nNon-security issues fixed :\n\n - Improved the speed and usability of osc bash completion.\n\n - improved some error messages.\n\n - osc add: support git@ (private github) or git:// URLs correctly.\n\n - Split dependson and whatdependson commands.\n\n - Added support for osc build --shell-cmd.\n\n - Added pkg-ccache support for osc build.\n\n - Added --ccache option to osc getbinaries \n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.", "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2020-07-20T00:00:00", "type": "nessus", "title": "openSUSE Security Update : osc (openSUSE-2020-852)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-3681"], "modified": "2020-07-22T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:osc", "cpe:/o:novell:opensuse:15.1"], "id": "OPENSUSE-2020-852.NASL", "href": "https://www.tenable.com/plugins/nessus/138699", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2020-852.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(138699);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/07/22\");\n\n script_cve_id(\"CVE-2019-3681\");\n\n script_name(english:\"openSUSE Security Update : osc (openSUSE-2020-852)\");\n script_summary(english:\"Check for the openSUSE-2020-852 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for osc to 0.169.1 fixes the following issues :\n\nSecurity issue fixed :\n\n - CVE-2019-3681: Fixed an insufficient validation of\n network-controlled filesystem paths (bsc#1122675).\n\nNon-security issues fixed :\n\n - Improved the speed and usability of osc bash completion.\n\n - improved some error messages.\n\n - osc add: support git@ (private github) or git:// URLs\n correctly.\n\n - Split dependson and whatdependson commands.\n\n - Added support for osc build --shell-cmd.\n\n - Added pkg-ccache support for osc build.\n\n - Added --ccache option to osc getbinaries \n\nThis update was imported from the SUSE:SLE-15-SP1:Update update\nproject.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1122675\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected osc package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:osc\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.1\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/06/29\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/06/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/07/20\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.1\", reference:\"osc-0.169.1-lp151.2.15.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"osc\");\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}], "suse": [{"lastseen": "2022-06-23T18:00:54", "description": "An update that fixes one vulnerability is now available.\n\nDescription:\n\n This update for osc to 0.169.1 fixes the following issues:\n\n Security issue fixed:\n\n - CVE-2019-3681: Fixed an insufficient validation of network-controlled\n filesystem paths (bsc#1122675).\n\n Non-security issues fixed:\n\n - Improved the speed and usability of osc bash completion.\n - improved some error messages.\n - osc add: support git@ (private github) or git:// URLs correctly.\n - Split dependson and whatdependson commands.\n - Added support for osc build --shell-cmd.\n - Added pkg-ccache support for osc build.\n - Added --ccache option to osc getbinaries\n\n This update was imported from the SUSE:SLE-15-SP1:Update update project.\n\n\nPatch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended installation methods\n like YaST online_update or \"zypper patch\".\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.1:\n\n zypper in -t patch openSUSE-2020-852=1", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2020-06-22T00:00:00", "type": "suse", "title": "Security update for osc (moderate)", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.4, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-3681"], "modified": "2020-06-22T00:00:00", "id": "OPENSUSE-SU-2020:0852-1", "href": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7JTMIEJBAUQNZZ6FCJLV6E4FFRRXUCTW/", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}], "cve": [{"lastseen": "2022-03-23T22:55:56", "description": "A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc versions prior to 0.169.0 .", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2020-06-29T12:15:00", "type": "cve", "title": "CVE-2019-3681", "cwe": ["CWE-73"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.4, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-3681"], "modified": "2020-07-09T18:06:00", "cpe": [], "id": "CVE-2019-3681", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-3681", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}, "cpe23": []}], "debiancve": [{"lastseen": "2021-12-14T17:51:23", "description": "A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc versions prior to 0.169.0 .", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-06-29T12:15:00", "type": "debiancve", "title": "CVE-2019-3681", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.4, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-3681"], "modified": "2020-06-29T12:15:00", "id": "DEBIANCVE:CVE-2019-3681", "href": "https://security-tracker.debian.org/tracker/CVE-2019-3681", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}], "ubuntucve": [{"lastseen": "2022-01-21T20:25:42", "description": "A External Control of File Name or Path vulnerability in osc of SUSE Linux\nEnterprise Module for Development Tools 15, SUSE Linux Enterprise Software\nDevelopment Kit 12-SP5, SUSE Linux Enterprise Software Development Kit\n12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that\ncan change downloaded packages to overwrite arbitrary files. This issue\naffects: SUSE Linux Enterprise Module for Development Tools 15 osc versions\nprior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit\n12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software\nDevelopment Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap\n15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc\nversions prior to 0.169.0 .", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-06-29T00:00:00", "type": "ubuntucve", "title": "CVE-2019-3681", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.4, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-3681"], "modified": "2020-06-29T00:00:00", "id": "UB:CVE-2019-3681", "href": "https://ubuntu.com/security/CVE-2019-3681", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}}]}