CVE-2018-12477 obs-service-refresh_patches can be tricked into deleting '..' or other unrelated directories
HighCVSS 7.5
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-service-refresh_patches to delete them. Affected releases are openSUSE Open Build Service: versions prior to d6244245dda5367767efc989446fe4b5e4609cce.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openSUSE leap | = 15.0 | No fix listed |
| openSUSE leap | = 42.3 | No fix listed |
| openSUSE open build service | < d6244245dda5367767efc989446fe4b5e4609cce | d6244245dda5367767efc989446fe4b5e4609cce |
References
- bugzilla.suse.com
- lwn.net mailing-list third-party-advisory