cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitrary files via a symlink within an RPM package archive.

This OBS toolchain update fixes the following issues :

Package 'build' :

  - CVE-2010-4226: force use of bsdtar for VMs (bnc#665768)

  - CVE-2017-14804: Improve file name check extractbuild     (bsc#1069904)

  - switch baselibs scheme for debuginfo packages from     foo-debuginfo-32bit to foo-32bit-debuginfo (fate#323217)

Package 'obs-service-source_validator' :

  - CVE-2017-9274: Don't use rpmbuild to extract sources,     patches etc. from a spec (bnc#938556).

  - Update to version 0.7

  - use spec_query instead of output_versions using the     specfile parser from the build package (boo#1059858)

Package 'osc' :

  - update to version 0.162.0

  - add Recommends: ca-certificates to enable TLS     verification without manually installing them.
    (bnc#1061500)

This update was imported from the SUSE:SLE-12:Update update project.

The build script uses cpio to extract untrusted rpm packages for bootstrapping virtual machines. cpio is not safe to use for this task, therefore the build script now uses bsdtar instead (CVE-2010-4226).

The build script uses cpio to extract untrusted rpm packages for bootstrapping virtual machines. cpio is not safe to use for this task, therefore the build script now uses bsdtar instead. (CVE-2010-4226)

ID	Name	Product	Family	Severity
105242	openSUSE Security Update : the OBS toolchain (openSUSE-2017-1360)	Nessus	SuSE Local Security Checks	high
75442	openSUSE Security Update : build (openSUSE-SU-2011:0174-1)	Nessus	SuSE Local Security Checks	medium
57163	SuSE 10 Security Update : build (ZYPP Patch Number 7395)	Nessus	SuSE Local Security Checks	medium
53699	openSUSE Security Update : build (openSUSE-SU-2011:0174-1)	Nessus	SuSE Local Security Checks	medium
53234	SuSE 10 Security Update : build (ZYPP Patch Number 7372)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2010-4226

high

Tenable Plugins

high

medium

medium

medium

medium