Описание
A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| osc | fixed | 0.162.1-1 | package | |
| osc | no-dsa | stretch | package | |
| osc | no-dsa | jessie | package | |
| osc | no-dsa | wheezy | package |
Примечания
Details in https://bugzilla.suse.com/show_bug.cgi?id=938556
SUSE adressed the issue not only in the obs-service-source_validator
and adding a validation in 0.162.0 when using OBS 2.9, cf.:
https://github.com/openSUSE/osc/commit/f0325eb0b58c266eb0905ccf827dc7eb864378a1
Связанные уязвимости
A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.
A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.
A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.
