Crafted projects can overwrite special files in the .osc config directory (SUSE SUSE Linux Enterprise Desktop 15 SP5)

CVE-2024-22034

MEDIUM 5.5

En bref

Source: NVD
EPSS: EPSS 0.21 % · centile 11 (2026-10-30)
État: PUBLISHED
Publiée: 2024-10-16 13:46 UTC
Mise à jour: 2024-10-31 13:34 UTC
Attribuée par: suse
Statut NVD: Deferred

Rechercher sur…

Description

Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim

Références

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22034

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	suse
CVSS 3.1	MEDIUM 5.5	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	NVD · meissner@suse.de (Secondary)

Références européennes

ENISA EUVD · EUVD-2024-19638
GCVE · GCVE-0-2024-22034

Produits affectés

Produit	Versions
SUSE · SUSE Linux Enterprise Desktop 15 SP5	affected ? < 1.9.0-150400.10.6.1
SUSE · SUSE Linux Enterprise High Performance Computing 15 SP5	affected ? < 1.9.0-150400.10.6.1
SUSE · SUSE Linux Enterprise Module for Development Tools 15 SP5	affected ? < 1.9.0-150400.10.6.1
SUSE · SUSE Linux Enterprise Server 15 SP5	affected ? < 1.9.0-150400.10.6.1
SUSE · SUSE Linux Enterprise Server for SAP Applications 15 SP5	affected ? < 1.9.0-150400.10.6.1
SUSE · SUSE Linux Enterprise Desktop 15 SP6	affected ? < 1.9.0-150400.10.6.1
SUSE · SUSE Linux Enterprise High Performance Computing 15 SP6	affected ? < 1.9.0-150400.10.6.1
SUSE · SUSE Linux Enterprise Module for Development Tools 15 SP6	affected ? < 1.9.0-150400.10.6.1
SUSE · SUSE Linux Enterprise Server 15 SP6	affected ? < 1.9.0-150400.10.6.1
SUSE · SUSE Linux Enterprise Server for SAP Applications 15 SP6	affected ? < 1.9.0-150400.10.6.1
SUSE · SUSE Linux Enterprise Server 12 SP5	affected ? < 0.183.0-15.18.1
SUSE · SUSE Linux Enterprise Server for SAP Applications 12 SP5	affected ? < 0.183.0-15.18.1
SUSE · SUSE Linux Enterprise Software Development Kit 12 SP5	affected ? < 0.183.0-15.18.1
SUSE · openSUSE Leap 15.5	affected ? < 1.9.0-150400.10.6.1
SUSE · openSUSE Leap 15.6	affected ? < 1.9.0-150400.10.6.1
SUSE · openSUSE Tumbleweed	affected ? < 1.9.0-1.1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD