Fixing security issues on OBS toolchain SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0065-1 Final 1 1 2018-01-11T10:25:14Z current 2018-01-11T10:25:14Z 2018-01-11T10:25:14Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Fixing security issues on OBS toolchain This OBS toolchain update fixes the following issues: Package 'build': - CVE-2017-14804: Improve file name check extractbuild (bsc#1069904) - Fixed Dockerfile repository parsing Package 'obs-service-source_validator': - CVE-2017-9274: Don't use rpmbuild to extract sources, patches etc. from a spec (bnc#938556). - CVE-2016-4007: Several maintained source services are vulnerable to code/paramter injection (bsc#967265) - Update to version 0.7. - Use spec_query instead of output_versions using the specfile parser from the build package (boo#1059858) - obs-service-source_validator: several occurrences of uninitialized value (bsc#967610) - hack for util-linux specfiles (bnc#891829) - fix dependency to gnupg2 for Fedora (bnc#827480) - exit if tmpdir creation fails (bnc#796918) Package 'osc': - Update to version 0.162.0. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-build-13404 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180065-1/ Link for SUSE-SU-2018:0065-1 https://lists.opensuse.org/opensuse-security-announce/2018-01/msg00030.html E-Mail link for SUSE-SU-2018:0065-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1059858 SUSE Bug 1059858 https://bugzilla.suse.com/1069904 SUSE Bug 1069904 https://bugzilla.suse.com/796918 SUSE Bug 796918 https://bugzilla.suse.com/827480 SUSE Bug 827480 https://bugzilla.suse.com/891829 SUSE Bug 891829 https://bugzilla.suse.com/938556 SUSE Bug 938556 https://bugzilla.suse.com/967265 SUSE Bug 967265 https://bugzilla.suse.com/967610 SUSE Bug 967610 https://www.suse.com/security/cve/CVE-2016-4007/ SUSE CVE CVE-2016-4007 page https://www.suse.com/security/cve/CVE-2017-14804/ SUSE CVE CVE-2017-14804 page https://www.suse.com/security/cve/CVE-2017-9274/ SUSE CVE CVE-2017-9274 page SUSE Linux Enterprise Software Development Kit 11 SP4 build-20171128-8.3.3 osc-0.162.1-7.4.1 build-20171128-8.3.3 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 osc-0.162.1-7.4.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with "illegal options." CVE-2016-4007 SUSE Linux Enterprise Software Development Kit 11 SP4:build-20171128-8.3.3 SUSE Linux Enterprise Software Development Kit 11 SP4:osc-0.162.1-7.4.1 moderate 6.6 AV:L/AC:M/Au:S/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180065-1/ https://www.suse.com/security/cve/CVE-2016-4007.html CVE-2016-4007 https://bugzilla.suse.com/967265 SUSE Bug 967265 The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots. CVE-2017-14804 SUSE Linux Enterprise Software Development Kit 11 SP4:build-20171128-8.3.3 SUSE Linux Enterprise Software Development Kit 11 SP4:osc-0.162.1-7.4.1 important 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180065-1/ https://www.suse.com/security/cve/CVE-2017-14804.html CVE-2017-14804 https://bugzilla.suse.com/1069904 SUSE Bug 1069904 A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs. CVE-2017-9274 SUSE Linux Enterprise Software Development Kit 11 SP4:build-20171128-8.3.3 SUSE Linux Enterprise Software Development Kit 11 SP4:osc-0.162.1-7.4.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180065-1/ https://www.suse.com/security/cve/CVE-2017-9274.html CVE-2017-9274 https://bugzilla.suse.com/938556 SUSE Bug 938556