CVE-2018-12467 delete package via link exploit in open buildservice
MediumCVSS 6.5
EPSS 0.65%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/open-build-service(Debian:12) | < 2.9.4-1 | 2.9.4-1 |
| openSUSE open build service | < 2.9.4 | 2.9.4 |
| ubuntu/open-build-service(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/open-build-service(Ubuntu:26.04) | All versions | No fix listed |
| openSUSE openbuildservice | < 9.2.4 | 9.2.4 |
References
- Debian Security Tracker CVE-2018-12467 vendor-advisory
- bugzilla.suse.com
- github.com
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- bugs.debian.org issue-tracking