A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc versions prior to 0.169.0 .

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for     Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise     Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can     change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module     for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development     Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc     versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE     Factory osc versions prior to 0.169.0 . (CVE-2019-3681)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4351-1 advisory.

    osc was updated to version 0.182.0 (bsc#1154972, bsc#1144211, bsc#1142662, bsc#1140697, bsc#1138165):

      - Added MFA support (jsc#OBS-203).
      - CVE-2019-3681: Fixed vulnerability where osc stored downloaded RPMs in network controlled paths     (bsc#1122675).
      - CVE-2019-3685: Fixed broken TLS certificate handling (bsc#1142518).

      Bugfixes:
      - Removed use of chardet to guess encoding. Utf-8 or latin-1 is now assumed, which will speed up     decoding (bsc#1173926).
      - Added helper method _html_escape to enable python3.8 and python2.* compatibility (bsc#1166537).
      - Added MR creation to honor orev (bsc#1160446).
      - Fixed local build outside of the working copy of a package (bsc#1136584).
      - Don't enforce password reuse (bsc#1156501).
      - osc vc --file=foo bar.changes now writes the content from foo into bar.changes instead of creating a     new file (bsc#1155953).
      - Fixed decoding on osc lbl (bsc#1137477).
      - Simplified and fixed osc meta -e (bsc#1138977).
      - osc lbl now works with non utf8 encoding (bsc#1129889).
      - Added full python3 compatibility (bsc#1125243, bsc#1131512, bsc#1129757).
      - Fixed slowdown of rbl with readline(bufsize) function (bsc#1127932).
      - Fixed osc build -p dir TypeError (bsc#1126055).
      - Fixed osc buildinfo -p TypeError (bsc#1126058).
      - Added new options --unexpand and --meta to diff command (bsc#1089025).
      - Fixed Requires to python-base which does not contain ssl.py (bsc#1097996).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for osc to 0.169.1 fixes the following issues :

Security issue fixed :

  - CVE-2019-3681: Fixed an insufficient validation of     network-controlled filesystem paths (bsc#1122675).

Non-security issues fixed :

  - Improved the speed and usability of osc bash completion.

  - improved some error messages.

  - osc add: support git@ (private github) or git:// URLs     correctly.

  - Split dependson and whatdependson commands.

  - Added support for osc build --shell-cmd.

  - Added pkg-ccache support for osc build.

  - Added --ccache option to osc getbinaries 

This update was imported from the SUSE:SLE-15-SP1:Update update project.

ID	Name	Product	Family	Type	Severity
259017	Linux Distros Unpatched Vulnerability : CVE-2019-3681	Nessus	Misc.	Local	critical
168492	SUSE SLES12 Security Update : osc (SUSE-SU-2022:4351-1)	Nessus	SuSE Local Security Checks	Local	critical
138699	openSUSE Security Update : osc (openSUSE-2020-852)	Nessus	SuSE Local Security Checks	Local	critical

Detections

Analytics

CVE-2019-3681

critical

Tenable Plugins

critical

critical

critical