PT-2019-4778 · Opensuse+1 · Open Build Service+1
Wolfgang Frisch
·
Publicado
2019-08-06
·
Atualizado
2024-06-15
·
CVE-2019-3685
CVSS v2.0
9.0
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:P |
Name of the Vulnerable Software and Affected Versions
Open Build Service versions prior to 0.165.4
Description
The issue is related to errors in certificate authentication. It may allow a remote attacker to bypass existing security restrictions and implement a "man-in-the-middle" attack. The problem arises because Open Build Service before version 0.165.4 did not validate TLS certificates for HTTPS connections with the osc client binary.
Recommendations
For versions prior to 0.165.4, update to version 0.165.4 or later to resolve the issue. As a temporary workaround, consider disabling the use of HTTPS connections with the osc client binary until a patch is available. Restrict access to sensitive operations to minimize the risk of exploitation.
Exploit
Correção
Improper Certificate Validation
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Open Build Service
Suse