CVE-2010-3782

CVE-2010-3782 affects obs-server prior to 1.7.7, where a bug in the REST API implementation allows login by 'unconfirmed' accounts. This exposes unauthorized access through the authentication flow. The practical impact is limited to systems running affected obs-server versions and relying on unco...

openSUSE Security Update : osc (openSUSE-2019-1844)

This update for osc to version 0.165.4 fixes the following issues : Security issue fixed : - CVE-2019-3685: Fixed broken TLS certificate handling allowing for a Man-in-the-middle attack bsc1142518. Non-security issues fixed : - support different token operations runservice, release and rebuild...

openSUSE Security Update : obs-service-refresh_patches (openSUSE-2019-702)

This update for obs-service-refreshpatches fixes the following security issue : - An attacker creating a specially formated archive could have tricked the service in deleting directories that shouldn't be deleted boo1108189 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

Security update for obs-service-tar_scm (important)

openSUSE Security Update: Security update for obs-service-tarscm Announcement ID: openSUSE-SU-2019:0329-1 Rating: important References: 1076410 1082696 1105361 1107507 1107944 Cross-References: CVE-2018-12473 CVE-2018-12474 CVE-2018-12476 Affected Products: openSUSE Backports SLE-15 An update tha...

openSUSE Security Update : obs-service-tar_scm (openSUSE-2019-326)

This update for obs-service-tarscm fixes the following issues : Security vulnerabilities addressed : - CVE-2018-12473: Fixed a path traversal issue, which allowed users to access files outside of the repository using relative paths bsc1105361 - CVE-2018-12474: Fixed an issue whereby crafted servi...

openSUSE: Security Advisory for obs-service-tar_scm (openSUSE-SU-2019:0326-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for obs-service-tar_scm (important)

openSUSE Security Update: Security update for obs-service-tarscm Announcement ID: openSUSE-SU-2019:0326-1 Rating: important References: 1076410 1082696 1105361 1107507 1107944 Cross-References: CVE-2018-12473 CVE-2018-12474 CVE-2018-12476 Affected Products: openSUSE Leap 15.0 An update that solve...

Fedora 28 : obs-build / osc (2018-fe2cbf0c2b)

New version of osc and obs-build including fix for CVE-2017-14804 and support for container builds using buildah and podman. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clea...

CVE-2018-12474

Improper input validation in obs-service-tarscm of Open Build Service allows remote attackers to cause access and extract information outside the current build or cause the creation of file in attacker controlled locations. Affected releases are openSUSE Open Build Service: versions prior to...

Input validation

Improper input validation in obs-service-tarscm of Open Build Service allows remote attackers to cause access and extract information outside the current build or cause the creation of file in attacker controlled locations. Affected releases are openSUSE Open Build Service: versions prior to...

CVE-2018-12477

The CVE-2018-12477 issue affects Open Build Service’s component obs-service-refresh_patches. The vulnerability stems from improper neutralization of CRLF sequences, allowing an attacker to remotely cause deletion of directories by tricking obs-service-refresh_patches into deleting them. Affected ...

CVE-2018-12474 Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm

Improper input validation in obs-service-tarscm of Open Build Service allows remote attackers to cause access and extract information outside the current build or cause the creation of file in attacker controlled locations. Affected releases are openSUSE Open Build Service: versions prior to...

Path traversal

A path traversal traversal vulnerability in obs-service-tarscm of Open Build Service allows remote attackers to cause access files not in the current build. On the server itself this is prevented by confining the worker via KVM. Affected releases are openSUSE Open Build Service: versions prior to...

CVE-2018-12473

A path traversal traversal vulnerability in obs-service-tarscm of Open Build Service allows remote attackers to cause access files not in the current build. On the server itself this is prevented by confining the worker via KVM. Affected releases are openSUSE Open Build Service: versions prior to...

CVE-2018-12473

The CVE-2018-12473 path-traversal exists in obs-service-tar_scm of Open Build Service. It could allow access to files outside the current build. Affected releases are openSUSE Open Build Service versions prior to 70d1aa4cc4d7b940180553a63805c22fc62e2cf0. The issue has been addressed in security u...

openSUSE Security Update : obs-service-refresh_patches (openSUSE-2018-1029)

This update for obs-service-refreshpatches fixes the following security issue : - An attacker creating a specially formated archive could have tricked the service in deleting directories that shouldn't be deleted boo1108189 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

Security update for obs-service-refresh_patches (moderate)

This update for obs-service-refreshpatches fixes the following security issue: - An attacker creating a specially formated archive could have tricked the service in deleting directories that shouldn't be deleted boo1108189...

openSUSE: Security Advisory for obs-service-refresh_patches (openSUSE-SU-2018:2801-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for obs-service-refresh_patches (moderate)

This update for obs-service-refreshpatches fixes the following security issue: - An attacker creating a specially formated archive could have tricked the service in deleting directories that shouldn't be deleted boo1108189...

[SECURITY] Fedora 27 Update: obs-build-20180816-291.1.1.fc27

This package provides a script for building packages in a chroot environmen t. It is commonly used with the Open Build Service as the engine for building packages for a wide variety of distributions...