OESA-2022-1674

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1674
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2022-1674.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2022-1674
Upstream
Published
2022-05-25T11:03:49Z
Modified
2025-08-12T05:12:25.504663Z
Summary
obs-server security update
Details

The Open Build Service (OBS) backend is used to store all sources and binaries.It also calculates the need for new build jobs and distributes it.

Security Fix(es):

A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue affects: SUSE Open Build Service Open Build Service versions prior to 2.10.13.(CVE-2022-21949)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP1 / obs-server

Package

Name
obs-server
Purl
pkg:rpm/openEuler/obs-server&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.10.11-3.oe1

Ecosystem specific 

{
    "src": [
        "obs-server-2.10.11-3.oe1.src.rpm"
    ],
    "noarch": [
        "obs-api-2.10.11-3.oe1.noarch.rpm",
        "obs-common-2.10.11-3.oe1.noarch.rpm",
        "obs-server-2.10.11-3.oe1.noarch.rpm"
    ]
}

openEuler:20.03-LTS-SP3 / obs-server

Package

Name
obs-server
Purl
pkg:rpm/openEuler/obs-server&distro=openEuler-20.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.10.11-3.oe1

Ecosystem specific 

{
    "src": [
        "obs-server-2.10.11-3.oe1.src.rpm"
    ],
    "noarch": [
        "obs-api-2.10.11-3.oe1.noarch.rpm",
        "obs-common-2.10.11-3.oe1.noarch.rpm",
        "obs-server-2.10.11-3.oe1.noarch.rpm"
    ]
}