Fixing security issues on OBS toolchain

Announcement ID: SUSE-SU-2017:3253-1
Rating: important
References:
Cross-References:
CVSS scores:
  • CVE-2017-14804 ( SUSE ): 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • CVE-2017-14804 ( NVD ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  • CVE-2017-9274 ( SUSE ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • CVE-2017-9274 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:
  • SUSE Linux Enterprise Desktop 12 SP2
  • SUSE Linux Enterprise Desktop 12 SP3
  • SUSE Linux Enterprise High Performance Computing 12 SP2
  • SUSE Linux Enterprise High Performance Computing 12 SP3
  • SUSE Linux Enterprise Server 12 SP2
  • SUSE Linux Enterprise Server 12 SP3
  • SUSE Linux Enterprise Server for SAP Applications 12 SP2
  • SUSE Linux Enterprise Server for SAP Applications 12 SP3
  • SUSE Linux Enterprise Software Development Kit 12 12-SP2
  • SUSE Linux Enterprise Software Development Kit 12 SP3

An update that solves three vulnerabilities and has two security fixes can now be installed.

Description:

This OBS toolchain update fixes the following issues:

Package 'build':

  • CVE-2010-4226: force use of bsdtar for VMs (bnc#665768)
  • CVE-2017-14804: Improve file name check extractbuild (bsc#1069904)
  • switch baselibs scheme for debuginfo packages from foo-debuginfo-32bit to foo-32bit-debuginfo (fate#323217)

Package 'obs-service-source_validator': - CVE-2017-9274: Don't use rpmbuild to extract sources, patches etc. from a spec (bnc#938556). - Update to version 0.7 - use spec_query instead of output_versions using the specfile parser from the build package (boo#1059858)

Package 'osc': - update to version 0.162.0 - add Recommends: ca-certificates to enable TLS verification without manually installing them. (bnc#1061500)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Software Development Kit 12 12-SP2
    zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2028=1
  • SUSE Linux Enterprise Software Development Kit 12 SP3
    zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2028=1

Package List:

  • SUSE Linux Enterprise Software Development Kit 12 12-SP2 (noarch)
    • build-initvm-s390-20171128-9.3.2
    • build-initvm-x86_64-20171128-9.3.2
    • osc-0.162.0-15.3.1
    • build-20171128-9.3.2
    • obs-service-source_validator-0.7-9.3.1
    • build-mkbaselibs-20171128-9.3.2
  • SUSE Linux Enterprise Software Development Kit 12 SP3 (noarch)
    • build-initvm-s390-20171128-9.3.2
    • build-initvm-x86_64-20171128-9.3.2
    • osc-0.162.0-15.3.1
    • build-20171128-9.3.2
    • obs-service-source_validator-0.7-9.3.1
    • build-mkbaselibs-20171128-9.3.2

References: