CVE-2018-12474 Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm

Improper input validation in obs-service-tarscm of Open Build Service allows remote attackers to cause access and extract information outside the current build or cause the creation of file in attacker controlled locations. Affected releases are openSUSE Open Build Service: versions prior to...

CVE-2018-12474

CVE-2018-12474 is addressed by updates to obs-service-tar_scm in openSUSE/openSUSE Open Build Service. The vulnerability arises from improper input/parameter handling: crafted service parameters could trigger unexpected behavior, enabling an attacker to access files outside the target repository ...

CVE-2018-12477 obs-service-refresh_patches can be tricked into deleting '..' or other unrelated directories

A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-service-refreshpatches to delete them. Affected releases are openSUSE Open Build Service: versions prior to...

CVE-2018-12477

The CVE-2018-12477 issue affects Open Build Service’s component obs-service-refresh_patches. The vulnerability stems from improper neutralization of CRLF sequences, allowing an attacker to remotely cause deletion of directories by tricking obs-service-refresh_patches into deleting them. Affected ...

CVE-2018-12479

A Improper Input Validation vulnerability in Open Build Service allows remote attackers to cause DoS by specifying crafted request IDs. Affected releases are openSUSE Open Build Service: versions prior to 01b015ca2a320afc4fae823465d1e72da8bd60df...

CVE-2018-12479

CVE-2018-12479 pertains to the Open Build Service (OBS) used in openSUSE. The vulnerability is an Improper Input Validation flaw that enables remote attackers to cause a DoS by specifying crafted request IDs. The affected releases are the Open Build Service versions prior to 01b015ca2a320afc4fae8...

CVE-2018-12478

CVE-2018-12478 affects the Open Build Service (OBS) used by openSUSE. The vulnerability is described as an improper input validation flaw that could allow remote attackers to extract files from the system hosting OBS. Affected releases are listed as openSUSE Open Build Service with status unknown...

Path traversal

A path traversal traversal vulnerability in obs-service-tarscm of Open Build Service allows remote attackers to cause access files not in the current build. On the server itself this is prevented by confining the worker via KVM. Affected releases are openSUSE Open Build Service: versions prior to...

CVE-2018-12473

A path traversal traversal vulnerability in obs-service-tarscm of Open Build Service allows remote attackers to cause access files not in the current build. On the server itself this is prevented by confining the worker via KVM. Affected releases are openSUSE Open Build Service: versions prior to...

CVE-2018-12473

A path traversal traversal vulnerability in obs-service-tarscm of Open Build Service allows remote attackers to cause access files not in the current build. On the server itself this is prevented by confining the worker via KVM. Affected releases are openSUSE Open Build Service: versions prior to...

CVE-2018-12473

The CVE-2018-12473 path-traversal exists in obs-service-tar_scm of Open Build Service. It could allow access to files outside the current build. Affected releases are openSUSE Open Build Service versions prior to 70d1aa4cc4d7b940180553a63805c22fc62e2cf0. The issue has been addressed in security u...

CVE-2018-12473 path traversal in obs-service-tar_scm

A path traversal traversal vulnerability in obs-service-tarscm of Open Build Service allows remote attackers to cause access files not in the current build. On the server itself this is prevented by confining the worker via KVM. Affected releases are openSUSE Open Build Service: versions prior to...

[SECURITY] Fedora 27 Update: osc-0.163.0-237.1.1.fc27

Commandline client for the Open Build Service. See http://en.opensuse.org/openSUSE:OSC , as well as http://en.opensuse.org/openSUSE:BuildServiceTutorial for a general introduction...

[SECURITY] Fedora 27 Update: obs-build-20180816-291.1.1.fc27

This package provides a script for building packages in a chroot environmen t. It is commonly used with the Open Build Service as the engine for building packages for a wide variety of distributions...

[SECURITY] Fedora 28 Update: osc-0.163.0-237.1.1.fc28

Commandline client for the Open Build Service. See http://en.opensuse.org/openSUSE:OSC , as well as http://en.opensuse.org/openSUSE:BuildServiceTutorial for a general introduction...

[SECURITY] Fedora 28 Update: obs-build-20180816-291.1.1.fc28

This package provides a script for building packages in a chroot environmen t. It is commonly used with the Open Build Service as the engine for building packages for a wide variety of distributions...

UBUNTU-CVE-2018-12467

Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689...

DEBIAN-CVE-2018-12466

openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links...

DEBIAN-CVE-2018-12467

Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689...

SUSE open build service file upload vulnerability

SUSE open build service OBS is a software distribution system. It enables building and distributing software packages from source code in an automated, consistent and repeatable manner. A security vulnerability exists in SUSE OBS. A remote attacker could exploit this vulnerability to upload...