CVE-2018-12476

Upstream information

CVE-2018-12476 at MITRE

Description

Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a repository to overwrite files on the machine of the local user if a malicious service is executed. This issue affects: SUSE Linux Enterprise Server 15 obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74:. openSUSE Factory obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74.

---

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	6.4
Vector	AV:N/AC:L/Au:N/C:N/I:P/A:P
Access Vector	Network
Access Complexity	Low
Authentication	None
Confidentiality Impact	None
Integrity Impact	Partial
Availability Impact	Partial

CVSS v3 Scores

	National Vulnerability Database
Base Score	7.5
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Access Vector	Network
Access Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality Impact	None
Integrity Impact	High
Availability Impact	None
CVSSv3 Version	3.1

SUSE Bugzilla entry: 1107944 [RESOLVED / FIXED]

SUSE Security Advisories:

• SUSE-SU-2019:0540-1, published Mon Mar 4 13:55:26 MST 2019
• openSUSE-SU-2019:0326-1, published Thu, 14 Mar 2019 00:09:19 +0100 (CET)
• openSUSE-SU-2019:0329-1, published Fri, 15 Mar 2019 12:09:30 +0100 (CET)

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15	obs-service-appimage >= 0.10.5.1551309990.79898c7-3.3.1 obs-service-obs_scm >= 0.10.5.1551309990.79898c7-3.3.1 obs-service-obs_scm-common >= 0.10.5.1551309990.79898c7-3.3.1 obs-service-snapcraft >= 0.10.5.1551309990.79898c7-3.3.1 obs-service-tar >= 0.10.5.1551309990.79898c7-3.3.1 obs-service-tar_scm >= 0.10.5.1551309990.79898c7-3.3.1	Patchnames: SUSE-SLE-Module-Development-Tools-OBS-15-2019-540
SUSE Linux Enterprise Software Development Kit 12 SP5	obs-service-appimage >= 0.10.6.1551887937.e42c270-1.3.1 obs-service-obs_scm >= 0.10.6.1551887937.e42c270-1.3.1 obs-service-obs_scm-common >= 0.10.6.1551887937.e42c270-1.3.1 obs-service-snapcraft >= 0.10.6.1551887937.e42c270-1.3.1 obs-service-tar >= 0.10.6.1551887937.e42c270-1.3.1 obs-service-tar_scm >= 0.10.6.1551887937.e42c270-1.3.1
SUSE Package Hub for SUSE Linux Enterprise 15	obs-service-appimage >= 0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-obs_scm >= 0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-obs_scm-common >= 0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-snapcraft >= 0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-tar >= 0.10.5.1551309990.79898c7-bp150.3.3.1 obs-service-tar_scm >= 0.10.5.1551309990.79898c7-bp150.3.3.1	Patchnames: openSUSE-2019-329
openSUSE Leap 15.0	obs-service-appimage >= 0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-obs_scm >= 0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-obs_scm-common >= 0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-snapcraft >= 0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-tar >= 0.10.5.1551309990.79898c7-lp150.2.3.1 obs-service-tar_scm >= 0.10.5.1551309990.79898c7-lp150.2.3.1	Patchnames: openSUSE-2019-326