Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2018-12476

obs-service-extract_file's outfilename parameter allows to write files outside of package directory

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
microfocus

Description

Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a repository to overwrite files on the machine of the local user if a malicious service is executed. This issue affects: SUSE Linux Enterprise Server 15 obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74:. openSUSE Factory obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE SUSE Linux Enterprise Server 15

  • obs-service-tar_scm to < 0.9.2.1537788075.fefaa74:affected

openSUSE Factory

  • obs-service-tar_scm to < 0.9.2.1537788075.fefaa74affected

References