CVE-2017-9274 osc executes spec code during "osc commit"
HighCVSS 7.8
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/osc(Debian:12) | < 0.162.1-1 | 0.162.1-1 |
| debian/osc(Debian:13) | < 0.162.1-1 | 0.162.1-1 |
| debian/osc(Debian:14) | < 0.162.1-1 | 0.162.1-1 |
| openSUSE obs-service-source validator | < 0.7 | 0.7 |
| SUSE obs-service-source_validator | < 0.7 | 0.7 |
References
- Debian Security Tracker CVE-2017-9274 vendor-advisory
- bugzilla.suse.com
- SUSE-SU-2017:3253 vendor-advisory
- www.suse.com
- bugs.debian.org issue-tracking