PT-2018-4340 · Opensuse · Open Build Service

Marcus Huewe + 1 · Publicado 2018-03-02 · Atualizado 2019-10-09 · CVE-2015-0796

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions open buildservice versions 2.4 through 2.4.7 open buildservice versions 2.5 through 2.5.6 open buildservice versions 2.6 through 2.6.2

Description The issue allows buildservice users to potentially break out of confinement or cause denial of service attacks on the source service due to the generation of non-standard files like symlinks or device nodes by the source service patch application.

Recommendations For open buildservice versions 2.4 through 2.4.7, update to version 2.4.8 or later. For open buildservice versions 2.5 through 2.5.6, update to version 2.5.7 or later. For open buildservice versions 2.6 through 2.6.2, update to version 2.6.3 or later.

Correção

Link Following

Unrestricted File Upload

Enumeração de Fraquezas

CWE-59

CWE-434

Identificadores relacionados

CVE-2015-0796

Produtos afetados

Open Build Service

Referências · 3

• https://github.com/openSUSE/open-build-service/commit/474a3db19498765f0118ba3dbc0b1cc90b0097fc · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-0796 · Nota de Segurança
• https://bugzilla.suse.com/show_bug.cgi?id=941099 · Nota