{"id":"CVE-2024-22034","state":"PUBLISHED","title":"Crafted projects can overwrite special files in the .osc config directory","description":"Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim","publishedAt":"2024-10-16T13:46:08.416Z","updatedAt":"2024-10-31T13:34:34.435Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","source":"suse"},"assigner":"suse","products":["SUSE SUSE Linux Enterprise Desktop 15 SP5","SUSE SUSE Linux Enterprise High Performance Computing 15 SP5","SUSE SUSE Linux Enterprise Module for Development Tools 15 SP5","SUSE SUSE Linux Enterprise Server 15 SP5","SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP5","SUSE SUSE Linux Enterprise Desktop 15 SP6","SUSE SUSE Linux Enterprise High Performance Computing 15 SP6","SUSE SUSE Linux Enterprise Module for Development Tools 15 SP6","SUSE SUSE Linux Enterprise Server 15 SP6","SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP6","SUSE SUSE Linux Enterprise Server 12 SP5","SUSE SUSE Linux Enterprise Server for SAP Applications 12 SP5","SUSE SUSE Linux Enterprise Software Development Kit 12 SP5","SUSE openSUSE Leap 15.5","SUSE openSUSE Leap 15.6","SUSE openSUSE Tumbleweed"],"affected":[{"vendor":"SUSE","product":"SUSE Linux Enterprise Desktop 15 SP5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise High Performance Computing 15 SP5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Module for Development Tools 15 SP5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Server 15 SP5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Server for SAP Applications 15 SP5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Desktop 15 SP6","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise High Performance Computing 15 SP6","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Module for Development Tools 15 SP6","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Server 15 SP6","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Server for SAP Applications 15 SP6","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Server 12 SP5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"0.183.0-15.18.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Server for SAP Applications 12 SP5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"0.183.0-15.18.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Software Development Kit 12 SP5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"0.183.0-15.18.1","versionType":"custom"}]},{"vendor":"SUSE","product":"openSUSE Leap 15.5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"openSUSE Leap 15.6","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"openSUSE Tumbleweed","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-1.1","versionType":"custom"}]}],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22034"],"weaknesses":[],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/22xxx/CVE-2024-22034.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-22034","state":"PUBLISHED","datePublished":"2024-10-16T13:46:08.416Z","dateUpdated":"2024-10-31T13:34:34.435Z","assignerShortName":"suse","assignerOrgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","dateReserved":"2024-01-04T12:38:34.024Z"},"containers":{"cna":{"title":"Crafted projects can overwrite special files in the .osc config directory","descriptions":[{"lang":"en","value":"Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim"}],"affected":[{"vendor":"SUSE","product":"SUSE Linux Enterprise Desktop 15 SP5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise High Performance Computing 15 SP5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Module for Development Tools 15 SP5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Server 15 SP5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Server for SAP Applications 15 SP5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Desktop 15 SP6","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise High Performance Computing 15 SP6","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Module for Development Tools 15 SP6","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Server 15 SP6","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Server for SAP Applications 15 SP6","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Server 12 SP5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"0.183.0-15.18.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Server for SAP Applications 12 SP5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"0.183.0-15.18.1","versionType":"custom"}]},{"vendor":"SUSE","product":"SUSE Linux Enterprise Software Development Kit 12 SP5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"0.183.0-15.18.1","versionType":"custom"}]},{"vendor":"SUSE","product":"openSUSE Leap 15.5","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"openSUSE Leap 15.6","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-150400.10.6.1","versionType":"custom"}]},{"vendor":"SUSE","product":"openSUSE Tumbleweed","packageName":"osc","defaultStatus":"unaffected","versions":[{"version":"?","status":"affected","lessThan":"1.9.0-1.1","versionType":"custom"}]}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22034"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"providerMetadata":{"shortName":"suse","orgId":"404e59f5-483d-4b8a-8e7a-e67604dd8afb","dateUpdated":"2024-10-16T13:46:08.416Z"},"credits":[{"lang":"en","type":"finder","value":"Daniel Mach of SUSE"}],"datePublic":"2024-08-19T11:42:00.000Z","source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-16T14:01:15.655473Z","id":"CVE-2024-22034","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"type":"CWE","lang":"en","description":"CWE-noinfo Not enough information"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-31T13:34:34.435Z"}}]}}}