CVE-2017-9274 HIGH

CVE-2017-9274: osc executes spec code during "osc commit"

Vendor Suse
Product obs-service-source_validator
Weakness CWE-78
Published March 1, 2018
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

7.8/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.

Key dates

02Disclosure timeline

March 1, 2018 CVE published
September 16, 2024 Record updated