SUSE-SU-2018:0065-1

See a problem?
Please try reporting it to the source first.

Source

Import Source

JSON Data

https://api.test.osv.dev/v1/vulns/SUSE-SU-2018:0065-1

Related

Published

2018-01-11T10:25:14Z

Modified

2025-05-08T17:01:56.051344Z

Upstream

Summary

Fixing security issues on OBS toolchain

Details

This OBS toolchain update fixes the following issues:

Package 'build':

Package 'obs-service-source_validator':

CVE-2017-9274: Don't use rpmbuild to extract sources, patches etc. from a spec (bnc#938556).
CVE-2016-4007: Several maintained source services are vulnerable to code/paramter injection (bsc#967265)
Update to version 0.7.
Use specquery instead of outputversions using the specfile parser from the build package (boo#1059858)
obs-service-source_validator: several occurrences of uninitialized value (bsc#967610)
hack for util-linux specfiles (bnc#891829)
fix dependency to gnupg2 for Fedora (bnc#827480)
exit if tmpdir creation fails (bnc#796918)

Package 'osc':

References

Affected packages

Name: build
Purl: pkg:rpm/suse/build&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

20171128-8.3.3

{
    "binaries": [
        {
            "osc": "0.162.1-7.4.1",
            "build": "20171128-8.3.3"
        }
    ]
}

Name: osc
Purl: pkg:rpm/suse/osc&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.162.1-7.4.1

{
    "binaries": [
        {
            "osc": "0.162.1-7.4.1",
            "build": "20171128-8.3.3"
        }
    ]
}