Detections
Analytics
openSUSE Security Update : the OBS toolchain (openSUSE-2017-1360)
high Nessus Plugin ID 105242
Language:
Synopsis
The remote openSUSE host is missing a security update.Description
This OBS toolchain update fixes the following issues :Package 'build' :
- CVE-2010-4226: force use of bsdtar for VMs (bnc#665768)
- CVE-2017-14804: Improve file name check extractbuild (bsc#1069904)
- switch baselibs scheme for debuginfo packages from foo-debuginfo-32bit to foo-32bit-debuginfo (fate#323217)
Package 'obs-service-source_validator' :
- CVE-2017-9274: Don't use rpmbuild to extract sources, patches etc. from a spec (bnc#938556).
- Update to version 0.7
- use spec_query instead of output_versions using the specfile parser from the build package (boo#1059858)
Package 'osc' :
- update to version 0.162.0
- add Recommends: ca-certificates to enable TLS verification without manually installing them.
(bnc#1061500)
This update was imported from the SUSE:SLE-12:Update update project.
Solution
Update the affected the OBS toolchain packages.See Also
https://bugzilla.opensuse.org/show_bug.cgi?id=1059858
https://bugzilla.opensuse.org/show_bug.cgi?id=1061500
https://bugzilla.opensuse.org/show_bug.cgi?id=1069904
https://bugzilla.opensuse.org/show_bug.cgi?id=665768
Plugin Details
Severity: High
ID: 105242
File Name: openSUSE-2017-1360.nasl
Version: 3.7
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 12/14/2017
Updated: 11/11/2025
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Continuous Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2017-9274
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:novell:opensuse:obs-service-source_validator, p-cpe:/a:novell:opensuse:osc, p-cpe:/a:novell:opensuse:build, cpe:/o:novell:opensuse:42.2, p-cpe:/a:novell:opensuse:build-initvm-x86_64, p-cpe:/a:novell:opensuse:build-mkdrpms, cpe:/o:novell:opensuse:42.3, p-cpe:/a:novell:opensuse:build-mkbaselibs, p-cpe:/a:novell:opensuse:build-initvm-i586
Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 12/9/2017