The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.

This update for build version 20190128 fixes the following issues :

Security issue fixed :

  - CVE-2017-14804: Improve file name check extractbuild     (bsc#1069904)

Non-security issue fixed :

  - Add initial SLE 15 SP1 config (bsc#1122895) This update     was imported from the SUSE:SLE-15:Update update project.

New version of `osc` and `obs-build` including fix for CVE-2017-14804 and support for container builds using `buildah` and `podman`.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This OBS toolchain update fixes the following issues :

Package 'build' :

  - CVE-2010-4226: force use of bsdtar for VMs (bnc#665768)

  - CVE-2017-14804: Improve file name check extractbuild     (bsc#1069904)

  - switch baselibs scheme for debuginfo packages from     foo-debuginfo-32bit to foo-32bit-debuginfo (fate#323217)

Package 'obs-service-source_validator' :

  - CVE-2017-9274: Don't use rpmbuild to extract sources,     patches etc. from a spec (bnc#938556).

  - Update to version 0.7

  - use spec_query instead of output_versions using the     specfile parser from the build package (boo#1059858)

Package 'osc' :

  - update to version 0.162.0

  - add Recommends: ca-certificates to enable TLS     verification without manually installing them.
    (bnc#1061500)

This update was imported from the SUSE:SLE-12:Update update project.

ID	Name	Product	Family	Severity
122416	openSUSE Security Update : build (openSUSE-2019-232)	Nessus	SuSE Local Security Checks	medium
120936	Fedora 28 : obs-build / osc (2018-fe2cbf0c2b)	Nessus	Fedora Local Security Checks	medium
117301	Fedora 27 : obs-build / osc (2018-fac5420dd1)	Nessus	Fedora Local Security Checks	medium
105242	openSUSE Security Update : the OBS toolchain (openSUSE-2017-1360)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-14804

medium

Tenable Plugins

medium

medium

medium

high