Security update for the OBS toolchain (important)

ID OPENSUSE-SU-2017:3259-1
Type suse
Reporter Suse
Modified 2017-12-09T12:08:35


This OBS toolchain update fixes the following issues:

Package 'build':

  • CVE-2010-4226: force use of bsdtar for VMs (bnc#665768)
  • CVE-2017-14804: Improve file name check extractbuild (bsc#1069904)
  • switch baselibs scheme for debuginfo packages from foo-debuginfo-32bit to foo-32bit-debuginfo (fate#323217)

Package 'obs-service-source_validator': - CVE-2017-9274: Don't use rpmbuild to extract sources, patches etc. from a spec (bnc#938556). - Update to version 0.7 - use spec_query instead of output_versions using the specfile parser from the build package (boo#1059858)

Package 'osc': - update to version 0.162.0 - add Recommends: ca-certificates to enable TLS verification without manually installing them. (bnc#1061500)

This update was imported from the SUSE:SLE-12:Update update project.