openSUSE Security Update : the OBS toolchain (openSUSE-2017-1360)

High Nessus Plugin ID 105242


The remote openSUSE host is missing a security update.


This OBS toolchain update fixes the following issues :

Package 'build' :

- CVE-2010-4226: force use of bsdtar for VMs (bnc#665768)

- CVE-2017-14804: Improve file name check extractbuild (bsc#1069904)

- switch baselibs scheme for debuginfo packages from foo-debuginfo-32bit to foo-32bit-debuginfo (fate#323217)

Package 'obs-service-source_validator' :

- CVE-2017-9274: Don't use rpmbuild to extract sources, patches etc. from a spec (bnc#938556).

- Update to version 0.7

- use spec_query instead of output_versions using the specfile parser from the build package (boo#1059858)

Package 'osc' :

- update to version 0.162.0

- add Recommends: ca-certificates to enable TLS verification without manually installing them.

This update was imported from the SUSE:SLE-12:Update update project.


Update the affected the OBS toolchain packages.

See Also

Plugin Details

Severity: High

ID: 105242

File Name: openSUSE-2017-1360.nasl

Version: 3.4

Type: local

Agent: unix

Published: 2017/12/14

Updated: 2018/12/18

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS v3.0

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:build, p-cpe:/a:novell:opensuse:build-initvm-i586, p-cpe:/a:novell:opensuse:build-initvm-x86_64, p-cpe:/a:novell:opensuse:build-mkbaselibs, p-cpe:/a:novell:opensuse:build-mkdrpms, p-cpe:/a:novell:opensuse:obs-service-source_validator, p-cpe:/a:novell:opensuse:osc, cpe:/o:novell:opensuse:42.2, cpe:/o:novell:opensuse:42.3

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list

Patch Publication Date: 2017/12/09

Reference Information

CVE: CVE-2010-4226, CVE-2017-14804, CVE-2017-9274