Описание
Security update for osc
This update for osc fixes the following issues:
0.183.0
- Fix possibility to overwrite special files in .osc (CVE-2024-22034 bsc#1225911) Source files are now stored in the 'sources' subdirectory which prevents name collisons. This requires changing version of '.osc' store to 2.0.
- Fix errorneous double quotes in core.py
Список пакетов
SUSE Linux Enterprise Software Development Kit 12 SP5
osc-0.183.0-15.18.1
Ссылки
- Link for SUSE-SU-2024:2963-1
- E-Mail link for SUSE-SU-2024:2963-1
- SUSE Security Ratings
- SUSE Bug 1225911
- SUSE CVE CVE-2024-22034 page
Описание
Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim
Затронутые продукты
SUSE Linux Enterprise Software Development Kit 12 SP5:osc-0.183.0-15.18.1
Ссылки
- CVE-2024-22034
- SUSE Bug 1225911