CVE-2017-9268 open-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions
MediumCVSS 6.5
EPSS 0.60%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of service (resource consumption).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/open-build-service(Debian:12) | < 2.9.4-1 | 2.9.4-1 |
| openSUSE open build service | <= 2.8.2 | No fix listed |
| ubuntu/open-build-service(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/open-build-service(Ubuntu:26.04) | All versions | No fix listed |
| SUSE Open Build Service | < 20170722 git | 20170722 git |
References
- Debian Security Tracker CVE-2017-9268 vendor-advisory
- bugzilla.suse.com
- github.com
- Ubuntu CVE tracker vendor-advisory
- www.cve.org