CVE-2018-12477: obs-service-refresh_patches can be tricked into deleting '..' or other unrelated directories
Published Oct 9, 2018
·Updated
A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-service-refreshpatches to delete them. Affected releases are openSUSE Open Build Service: versions prior to d6244245dda5367767efc989446fe4b5e4609cce.
Affected Software
2 affected components
openSUSE Leap=15.0
openSUSE Leap=42.3
Remediation
Patch Available
Event History
Oct 9, 2018
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable and requires no privileges or user interaction, according to the CVSS vector. An attacker can trick obs-service-refresh_patches into deleting directories.
2
What versions are affected?
Affected Open Build Service releases are those prior to commit d6244245dda5367767efc989446fe4b5e4609cce.
3
Is a fix available?
Yes. A patch is available; update to a release containing commit d6244245dda5367767efc989446fe4b5e4609cce or later.