CVE-2019-3681: SUSE Linux Enterprise Module for Development Tools 15

Описание

Оригинално описание

A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc versions prior to 0.169.0 .

Засегнати продукти

• SUSE SUSE Linux Enterprise Module for Development Tools 15: osc преди 0.169.1-3.20.1
• SUSE SUSE Linux Enterprise Software Development Kit 12-SP5: osc преди 0.162.1-15.9.1
• SUSE SUSE Linux Enterprise Software Development Kit 12-SP4: osc преди 0.162.1-15.9.1
• openSUSE openSUSE Leap 15.1: osc преди 0.169.1-lp151.2.15.1
• openSUSE openSUSE Factory: osc преди 0.169.0

Вид слабост

• CWE-73 Външен контрол върху име или път на файл

История

Други уязвимости в SUSE SUSE Linux Enterprise Module for Development Tools 15

• 7.3CVE-2020-8027
• 7.7CVE-2020-8023
• 6.1CVE-2020-8025
• 8.4CVE-2020-8026
• 7.7CVE-2020-8014

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2019-3681
• https://nvd.nist.gov/vuln/detail/CVE-2019-3681
• https://bugzilla.suse.com/show_bug.cgi?id=1122675