CVE-2018-7689

Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.

References

Affected packages

Git / github.com/opensuse/open-build-service

Affected ranges

Type

GIT

Repo

https://github.com/opensuse/open-build-service

Events

Introduced

Fixed

10f6b8fda18d5cf7b1a37061225738a9e07ea268

Fixed

990ef7cccef6f38fc1d1a1bb22a08e174dcba43b

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.9.3"
        }
    ]
}

Affected versions

1.*

1.9.90

1.9.91

1.9.92

2.*

2.3.60

2.3.90

2.3.91

2.4.50

2.4.51

2.5.50

2.9.0

2.9.1

2.9.2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-7689.json"