Vulnerability Name:

CVE-2017-9274 (CCN-139855)

Assigned:2017-07-17
Published:2017-07-17
Updated:2019-10-09
Summary:A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.
CVSS v3 Severity:7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
6.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-78
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2017-9274

Source: CCN
Type: Bugzilla – Bug 938556
VUL-0: CVE-2017-9274: osc executes spec code during "osc commit"

Source: CONFIRM
Type: Issue Tracking, Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=938556

Source: XF
Type: UNKNOWN
suse-cve20179274-cmd-exec(139855)

Source: CCN
Type: obs-service-source_validator GIT Repository
obs-service-source_validator

Source: SUSE
Type: Vendor Advisory
SUSE-SU-2017:3253

Source: CONFIRM
Type: Vendor Advisory
https://www.suse.com/de-de/security/cve/CVE-2017-9274/

Vulnerable Configuration:Configuration 1:
  • cpe:/a:opensuse:obs-service-source_validator:*:*:*:*:*:*:*:* (Version < 0.7)

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20179274
    V
    		CVE-2017-9274
    2022-09-02
    oval:org.opensuse.security:def:113050
    P
    		obs-service-source_validator-0.21-1.3 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:10444
    P
    		Security update for MozillaFirefox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:10429
    P
    		Security update for net-snmp (Important)
    2022-01-11
    oval:org.opensuse.security:def:10438
    P
    		Security update for java-1_8_0-ibm (Important) (in QA)
    2022-01-04
    oval:org.opensuse.security:def:10362
    P
    		Security update for MozillaFirefox (Important)
    2021-11-10
    oval:org.opensuse.security:def:10701
    P
    		Security update for transfig (Important)
    2021-10-29
    oval:org.opensuse.security:def:10160
    P
    		Security update for MozillaFirefox (Important)
    2021-10-11
    oval:org.opensuse.security:def:106490
    P
    		obs-service-source_validator-0.21-1.3 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:10138
    P
    		Security update for php7 (Important)
    2021-08-20
    oval:org.opensuse.security:def:10130
    P
    		Security update for webkit2gtk3 (Important)
    2021-08-17
    oval:org.opensuse.security:def:11111
    P
    		Recommended update for seamonkey (Low)
    2021-08-10
    oval:org.opensuse.security:def:10287
    P
    		Security update for salt (Critical)
    2021-06-21
    oval:org.opensuse.security:def:17266
    P
    		libnewt0_52-0.52.16-1.83 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:17178
    P
    		lhasa-0.2.0-5.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:11425
    P
    		ntp-4.2.6p5-24.3 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:17059
    P
    		kernel-default-extra-3.12.49-11.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:124631
    P
    		obs-service-source_validator-0.7-9.3.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:17235
    P
    		gegl-0_2-0.2.0-14.3 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:16625
    P
    		obs-service-source_validator-0.7-9.3.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:17051
    P
    		gcc48-gij-32bit-4.8.5-24.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:17093
    P
    		NetworkManager-1.0.12-8.6 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:11403
    P
    		libsnmp30-32bit-5.7.2.1-3.8 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:10676
    P
    		Security update for gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly (Important)
    2021-06-01
    oval:org.opensuse.security:def:10253
    P
    		Security update for webkit2gtk3 (Important)
    2021-05-04
    oval:org.opensuse.security:def:10387
    P
    		Security update for subversion (Important)
    2021-02-10
    oval:org.opensuse.security:def:10268
    P
    		Security update for wavpack (Moderate)
    2021-01-21
    oval:org.opensuse.security:def:10206
    P
    		Security update for nodejs10 (Moderate)
    2021-01-11
    oval:org.opensuse.security:def:16939
    P
    		obs-service-source_validator-0.7-9.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:17333
    P
    		lhasa-0.2.0-5.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:17375
    P
    		libyaml-cpp0_5-0.5.3-3.3.2 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4103
    P
    		obs-service-source_validator-0.7-9.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:17302
    P
    		ImageMagick-6.8.8.1-71.126.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:17341
    P
    		libgadu3-1.11.4-1.12 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:26662
    P
    		PackageKit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27163
    P
    		krb5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17817
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:10752
    P
    		libjson-c-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27304
    P
    		t1lib on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:10452
    P
    		hivex-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17694
    P
    		Security update for glibc (Important)
    2020-12-01
    oval:org.opensuse.security:def:10601
    P
    		sudo-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18173
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26928
    P
    		kdelibs4 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:10451
    P
    		gtk2-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17783
    P
    		Security update for gimp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17444
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:26587
    P
    		libgtop on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17548
    P
    		Security update for libarchive (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28000
    P
    		Security update for SDL (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:10567
    P
    		libzip-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17513
    P
    		Security update for flac (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26790
    P
    		ofed on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27216
    P
    		libsnmp15-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18455
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:10765
    P
    		libnettle-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17460
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:27318
    P
    		w3m on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:10474
    P
    		libXrender-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17726
    P
    		Security update for openssl (Important)
    2020-12-01
    oval:org.opensuse.security:def:26598
    P
    		libpulse-browse0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:18199
    P
    		Fixing security issues on OBS toolchain (Important)
    2020-12-01
    oval:org.opensuse.security:def:27012
    P
    		perl-HTML-Parser on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:11089
    P
    		libxcb-composite0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17795
    P
    		Security update for xerces-c (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:10743
    P
    		libicu-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17584
    P
    		Security update for libgcrypt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28035
    P
    		Fixing security issues on OBS toolchain (Important)
    2020-12-01
    oval:org.opensuse.security:def:10582
    P
    		pam-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17535
    P
    		Security update for postgresql93 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26871
    P
    		bzip2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27265
    P
    		perl-Tk on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17412
    P
    		Security update for the Linux Kernel (Live Patch 30 for SLE 12 SP3) (Important)
    2020-12-01
    oval:org.opensuse.security:def:18481
    P
    		Fixing security issues on OBS toolchain (Important)
    2020-12-01
    oval:org.opensuse.security:def:26586
    P
    		libexiv2-4 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17517
    P
    		Security update for php5 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27362
    P
    		OpenEXR-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:10520
    P
    		libmspack-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:17501
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:com.ubuntu.bionic:def:201792740000000
    V
    		CVE-2017-9274 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-03-01
    oval:com.ubuntu.artful:def:20179274000
    V
    		CVE-2017-9274 on Ubuntu 17.10 (artful) - medium.
    2018-03-01
    oval:com.ubuntu.xenial:def:20179274000
    V
    		CVE-2017-9274 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-03-01
    oval:com.ubuntu.xenial:def:201792740000000
    V
    		CVE-2017-9274 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-03-01
    oval:com.ubuntu.bionic:def:20179274000
    V
    		CVE-2017-9274 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-03-01
    oval:com.ubuntu.disco:def:201792740000000
    V
    		CVE-2017-9274 on Ubuntu 19.04 (disco) - medium.
    2018-03-01
    oval:com.ubuntu.cosmic:def:20179274000
    V
    		CVE-2017-9274 on Ubuntu 18.10 (cosmic) - medium.
    2018-03-01
    oval:com.ubuntu.cosmic:def:201792740000000
    V
    		CVE-2017-9274 on Ubuntu 18.10 (cosmic) - medium.
    2018-03-01
    oval:com.ubuntu.trusty:def:20179274000
    V
    		CVE-2017-9274 on Ubuntu 14.04 LTS (trusty) - medium.
    2018-03-01
    BACK
    opensuse obs-service-source validator *