Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4351-1 advisory.

  - A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for     Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise     Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can     change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module     for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development     Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc     versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE     Factory osc versions prior to 0.169.0 . (CVE-2019-3681)

  - Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the     osc client binary (CVE-2019-3685)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for osc to version 0.165.4 fixes the following issues :

Security issue fixed :

  - CVE-2019-3685: Fixed broken TLS certificate handling     allowing for a Man-in-the-middle attack (bsc#1142518).

Non-security issues fixed :

  - support different token operations (runservice, release     and rebuild) (requires OBS 2.10)

  - fix osc token decode error

  - offline build mode is now really offline and does not     try to download the buildconfig

  - osc build -define now works with python3

  - fixes an issue where the error message on osc meta -e     was not parsed correctly

  - osc maintainer -s now works with python3

  - simplified and fixed osc meta -e (bsc#1138977) 

  - osc lbl now works with non utf8 encoding (bsc#1129889)

  - add simpleimage as local build type 

  - allow optional fork when creating a maintenance request

  - fix RPMError fallback

  - fix local caching for all package formats

  - fix appname for trusted cert store

  - osc -h does not break anymore when using plugins 

  - switch to difflib.diff_bytes and sys.stdout.buffer.write     for diffing. This will fix all decoding issues with osc     diff, osc ci and osc rq -d

  - fix osc ls -lb handling empty size and mtime

  - removed decoding on osc api command.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

ID	Name	Product	Family	Severity
168492	SUSE SLES12 Security Update : osc (SUSE-SU-2022:4351-1)	Nessus	SuSE Local Security Checks	critical
127833	openSUSE Security Update : osc (openSUSE-2019-1844)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2019-3685

high

Tenable Plugins

critical

high