Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

open build service — Vulnerabilities & Security Advisories 19

All 19 CVE vulnerabilities found in open build service, with AI-generated Chinese analysis, references, and POCs.

This vulnerability aggregation page covers the Open Build Service, a widely used open-source platform for automated package building and distribution within the Linux ecosystem. The page collects and catalogs known software weaknesses, configuration errors, and coding flaws associated with the Open Build Service and its related components. It covers a comprehensive historical time range, documenting vulnerabilities reported from their initial disclosure through to their resolution or mitigation in recent updates. Here, security professionals and system administrators can track vendor advisories issued by the openSUSE project and other community maintainers to stay informed about emerging threats. Users can also gain a deeper understanding of specific weakness classes, such as injection flaws or permission misconfigurations, that have historically affected this build infrastructure. Additionally, the page allows users to look up the full vulnerability history of the product, providing context on how issues have been patched over time and which versions remain susceptible. This consolidated view helps teams assess risk more effectively by highlighting trends in defect patterns and the frequency of security patches. By presenting this data in a structured format, the page facilitates better incident response planning and helps developers identify common pitfalls in package management systems. The information serves as a practical reference for auditing build environments and ensuring that the underlying infrastructure adheres to current security best practices without requiring manual searching across multiple disparate sources.

Vendor: SUSE

CVE ID Title CVSS Severity Published
CVE-2022-21949 Multiple XXE vulnerabilities in OBS CWE-611 8.8 High 2022-05-03
CVE-2020-8031 obs: Stored XSS CWE-79 6.3 Medium 2021-02-11
CVE-2018-12475 obs-service-download_files allows downloading from localhost or intranet hosts CWE-610 6.5 Medium 2020-09-01
CVE-2020-8021 unauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service CWE-269 5.3 Medium 2020-05-19
CVE-2019-3685 Missing TLS certificate validation for HTTPS connections in osc CWE-295 7.4 High 2019-11-05
CVE-2018-12474 Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm CWE-20 8.8 - 2018-10-09
CVE-2018-12477 obs-service-refresh_patches can be tricked into deleting '..' or other unrelated directories CWE-93 6.5 - 2018-10-09
CVE-2018-12478 obs-service-replace_using_package_version allows to specify arbitrary input files CWE-20 6.5 - 2018-10-09
CVE-2018-12479 Request controller allows to create requests with arbitrary request IDs CWE-20 7.5 - 2018-10-09
CVE-2018-12473 path traversal in obs-service-tar_scm CWE-23 7.5 - 2018-10-02
CVE-2011-4183 open build service allows anyone to upload rpms CWE-862 9.8 - 2018-06-13
CVE-2011-4181 open build service information leak via unauthorized source access CWE-284 7.5 - 2018-06-11
CVE-2014-0594 CSRF protection incorrectly disabled CWE-352 8.8 - 2018-06-08
CVE-2013-3703 No write permission check in change_role command CWE-862 6.5 - 2018-06-08
CVE-2018-7688 Open Build Service accepts arbitrary reviews CWE-862 6.5 - 2018-06-07
CVE-2018-7689 Open Build Service arbitrary package modification CWE-862 6.5 - 2018-06-07
CVE-2015-0796 open build service source server symlink exploitation via source patch 7.7 - 2018-03-02
CVE-2017-5188 OBS worker VM escape via relative symbolic links 6.5 - 2018-03-01
CVE-2017-9268 open-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions 6.5 - 2018-03-01

All 19 known CVE vulnerabilities affecting open build service with full Chinese analysis, references, and POCs where available.