Security update for osc SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:4351-1 Final 1 1 2022-12-07T16:38:34Z current 2022-12-07T16:38:34Z 2022-12-07T16:38:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for osc This update for osc fixes the following issues: osc was updated to version 0.182.0 (bsc#1154972, bsc#1144211, bsc#1142662, bsc#1140697, bsc#1138165): - Added MFA support (jsc#OBS-203). - CVE-2019-3681: Fixed vulnerability where osc stored downloaded RPMs in network controlled paths (bsc#1122675). - CVE-2019-3685: Fixed broken TLS certificate handling (bsc#1142518). Bugfixes: - Removed use of chardet to guess encoding. Utf-8 or latin-1 is now assumed, which will speed up decoding (bsc#1173926). - Added helper method _html_escape to enable python3.8 and python2.* compatibility (bsc#1166537). - Added MR creation to honor orev (bsc#1160446). - Fixed local build outside of the working copy of a package (bsc#1136584). - Don't enforce password reuse (bsc#1156501). - osc vc --file=foo bar.changes now writes the content from foo into bar.changes instead of creating a new file (bsc#1155953). - Fixed decoding on osc lbl (bsc#1137477). - Simplified and fixed osc meta -e (bsc#1138977). - osc lbl now works with non utf8 encoding (bsc#1129889). - Added full python3 compatibility (bsc#1125243, bsc#1131512, bsc#1129757). - Fixed slowdown of rbl with readline(bufsize) function (bsc#1127932). - Fixed osc build -p dir TypeError (bsc#1126055). - Fixed osc buildinfo -p TypeError (bsc#1126058). - Added new options --unexpand and --meta to diff command (bsc#1089025). - Fixed Requires to python-base which does not contain ssl.py (bsc#1097996). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-4351,SUSE-SLE-SDK-12-SP5-2022-4351 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20224351-1/ Link for SUSE-SU-2022:4351-1 https://lists.suse.com/pipermail/sle-security-updates/2022-December/013202.html E-Mail link for SUSE-SU-2022:4351-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1089025 SUSE Bug 1089025 https://bugzilla.suse.com/1097996 SUSE Bug 1097996 https://bugzilla.suse.com/1122675 SUSE Bug 1122675 https://bugzilla.suse.com/1125243 SUSE Bug 1125243 https://bugzilla.suse.com/1126055 SUSE Bug 1126055 https://bugzilla.suse.com/1126058 SUSE Bug 1126058 https://bugzilla.suse.com/1127932 SUSE Bug 1127932 https://bugzilla.suse.com/1129757 SUSE Bug 1129757 https://bugzilla.suse.com/1129889 SUSE Bug 1129889 https://bugzilla.suse.com/1131512 SUSE Bug 1131512 https://bugzilla.suse.com/1136584 SUSE Bug 1136584 https://bugzilla.suse.com/1137477 SUSE Bug 1137477 https://bugzilla.suse.com/1138165 SUSE Bug 1138165 https://bugzilla.suse.com/1138977 SUSE Bug 1138977 https://bugzilla.suse.com/1140697 SUSE Bug 1140697 https://bugzilla.suse.com/1142518 SUSE Bug 1142518 https://bugzilla.suse.com/1142662 SUSE Bug 1142662 https://bugzilla.suse.com/1144211 SUSE Bug 1144211 https://bugzilla.suse.com/1154972 SUSE Bug 1154972 https://bugzilla.suse.com/1155953 SUSE Bug 1155953 https://bugzilla.suse.com/1156501 SUSE Bug 1156501 https://bugzilla.suse.com/1160446 SUSE Bug 1160446 https://bugzilla.suse.com/1166537 SUSE Bug 1166537 https://bugzilla.suse.com/1173926 SUSE Bug 1173926 https://www.suse.com/security/cve/CVE-2019-3681/ SUSE CVE CVE-2019-3681 page https://www.suse.com/security/cve/CVE-2019-3685/ SUSE CVE CVE-2019-3685 page SUSE Linux Enterprise Software Development Kit 12 SP5 osc-0.182.0-15.12.1 osc-0.182.0-15.12.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc versions prior to 0.169.0 . CVE-2019-3681 SUSE Linux Enterprise Software Development Kit 12 SP5:osc-0.182.0-15.12.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224351-1/ https://www.suse.com/security/cve/CVE-2019-3681.html CVE-2019-3681 https://bugzilla.suse.com/1122675 SUSE Bug 1122675 Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary CVE-2019-3685 SUSE Linux Enterprise Software Development Kit 12 SP5:osc-0.182.0-15.12.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224351-1/ https://www.suse.com/security/cve/CVE-2019-3685.html CVE-2019-3685 https://bugzilla.suse.com/1142518 SUSE Bug 1142518 https://bugzilla.suse.com/1142662 SUSE Bug 1142662