{"id":"SUSE-SU-2017:3253-1","summary":"Fixing security issues on OBS toolchain","details":"This OBS toolchain update fixes the following issues:\n\nPackage 'build':\n\n- CVE-2010-4226: force use of bsdtar for VMs (bnc#665768)\n- CVE-2017-14804: Improve file name check extractbuild (bsc#1069904)\n- switch baselibs scheme for debuginfo packages from foo-debuginfo-32bit to foo-32bit-debuginfo (fate#323217)\n\nPackage 'obs-service-source_validator':\n- CVE-2017-9274: Don't use rpmbuild to extract sources, patches etc. from a spec (bnc#938556).\n- Update to version 0.7\n- use spec_query instead of output_versions using the specfile parser from the build package (boo#1059858)\n\nPackage 'osc':\n- update to version 0.162.0\n- add Recommends: ca-certificates to enable TLS verification without manually installing them. (bnc#1061500)\n","modified":"2026-02-04T02:37:06.432056Z","published":"2017-12-08T12:54:18Z","related":["CVE-2010-4226","CVE-2017-14804","CVE-2017-9274"],"upstream":["CVE-2010-4226","CVE-2017-14804","CVE-2017-9274"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173253-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1059858"},{"type":"REPORT","url":"https://bugzilla.suse.com/1061500"},{"type":"REPORT","url":"https://bugzilla.suse.com/1069904"},{"type":"REPORT","url":"https://bugzilla.suse.com/665768"},{"type":"REPORT","url":"https://bugzilla.suse.com/938556"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2010-4226"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-14804"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-9274"}],"affected":[{"package":{"name":"build","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","purl":"pkg:rpm/suse/build&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20171128-9.3.2"}]}],"ecosystem_specific":{"binaries":[{"build":"20171128-9.3.2","obs-service-source_validator":"0.7-9.3.1","osc":"0.162.0-15.3.1","build-initvm-s390":"20171128-9.3.2","build-initvm-x86_64":"20171128-9.3.2","build-mkbaselibs":"20171128-9.3.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:3253-1.json"}},{"package":{"name":"obs-service-source_validator","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","purl":"pkg:rpm/suse/obs-service-source_validator&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-9.3.1"}]}],"ecosystem_specific":{"binaries":[{"build-initvm-x86_64":"20171128-9.3.2","build-mkbaselibs":"20171128-9.3.2","build":"20171128-9.3.2","obs-service-source_validator":"0.7-9.3.1","osc":"0.162.0-15.3.1","build-initvm-s390":"20171128-9.3.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:3253-1.json"}},{"package":{"name":"osc","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","purl":"pkg:rpm/suse/osc&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.162.0-15.3.1"}]}],"ecosystem_specific":{"binaries":[{"build-initvm-s390":"20171128-9.3.2","build-initvm-x86_64":"20171128-9.3.2","build-mkbaselibs":"20171128-9.3.2","build":"20171128-9.3.2","obs-service-source_validator":"0.7-9.3.1","osc":"0.162.0-15.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:3253-1.json"}},{"package":{"name":"build","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","purl":"pkg:rpm/suse/build&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20171128-9.3.2"}]}],"ecosystem_specific":{"binaries":[{"build-mkbaselibs":"20171128-9.3.2","build":"20171128-9.3.2","obs-service-source_validator":"0.7-9.3.1","osc":"0.162.0-15.3.1","build-initvm-s390":"20171128-9.3.2","build-initvm-x86_64":"20171128-9.3.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:3253-1.json"}},{"package":{"name":"obs-service-source_validator","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","purl":"pkg:rpm/suse/obs-service-source_validator&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7-9.3.1"}]}],"ecosystem_specific":{"binaries":[{"build-initvm-s390":"20171128-9.3.2","build-initvm-x86_64":"20171128-9.3.2","build-mkbaselibs":"20171128-9.3.2","build":"20171128-9.3.2","obs-service-source_validator":"0.7-9.3.1","osc":"0.162.0-15.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:3253-1.json"}},{"package":{"name":"osc","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","purl":"pkg:rpm/suse/osc&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.162.0-15.3.1"}]}],"ecosystem_specific":{"binaries":[{"build-initvm-s390":"20171128-9.3.2","build-initvm-x86_64":"20171128-9.3.2","build-mkbaselibs":"20171128-9.3.2","build":"20171128-9.3.2","obs-service-source_validator":"0.7-9.3.1","osc":"0.162.0-15.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:3253-1.json"}}],"schema_version":"1.7.3"}