PT-2020-19924 · Opensuse · Open Build Service

Marcus Hüwe · Published 2020-05-19 · Updated 2021-03-15 · CVE-2020-8021

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open Build Service versions prior to 2.10.5

Description The issue is related to an Improper Access Control vulnerability in Open Build Service, allowing remote attackers to read files of an OBS package where the source access is disabled.

Recommendations For Open Build Service versions prior to 2.10.5, update to version 2.10.5 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive OBS packages to minimize the risk of exploitation.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-8021

DLA-2545-1

Affected Products

Open Build Service

References · 12

• 🔥 https://bugzilla.suse.com/show_bug.cgi?id=1171649 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2020-8021 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-8021 · Security Note
• https://osv.dev/vulnerability/DLA-2545-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8021 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-8021 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-8021 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-8021 · Vendor Advisory
• https://t.me/cvenotify/11359 · Telegram Post
• https://t.me/cvenotify/3910 · Telegram Post
• https://lists.debian.org/debian-lts-announce/2021/02/msg00006.html · Note