CVE-2019-3681: A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software…

PriorityP260critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.42%

69.9th percentile

A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc versions prior to 0.169.0 .

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	osc	< osc 0.169.1-1 (bookworm)	osc 0.169.1-1 (bookworm)
opensuse	opensuse_factory	>= osc < 0.169.0	0.169.0
opensuse	opensuse_leap_15.1	>= osc < 0.169.1-lp151.2.15.1	0.169.1-lp151.2.15.1
opensuse	osc	< 0.169.1-3.20.1	0.169.1-3.20.1
opensuse	osc	< 0.162.1-15.9.1	0.162.1-15.9.1
opensuse	osc	< 0.169.1-lp151.2.15.1	0.169.1-lp151.2.15.1
opensuse	osc	< 0.169.0	0.169.0
opensuse	osc	>= 0 < 0.169.1-1	0.169.1-1
opensuse	osc	>= 0 < 0.169.1-1	0.169.1-1
opensuse	osc	>= 0 < 0.169.1-1	0.169.1-1
opensuse	osc	>= 0 < 0.169.1-1	0.169.1-1
suse	suse_linux_enterprise_module_for_development_tools_15	>= osc < 0.169.1-3.20.1	0.169.1-3.20.1
suse	suse_linux_enterprise_software_development_kit_12-sp4	>= osc < 0.162.1-15.9.1	0.162.1-15.9.1
suse	suse_linux_enterprise_software_development_kit_12-sp5	>= osc < 0.162.1-15.9.1	0.162.1-15.9.1

Detection & IOCsextracted from sources · hover to see the quote

→Detect osc storing downloaded RPM packages in network-controlled filesystem paths, which can lead to arbitrary file overwrite via path traversal in package filenames ↗
→Flag osc versions prior to 0.169.1 (SUSE Linux Enterprise Module for Development Tools 15) or prior to 0.162.1 (SDK 12-SP4/SP5) as vulnerable to external control of file name or path allowing arbitrary file overwrite ↗

·This vulnerability requires a remote attacker to be in a position to modify/control downloaded packages (e.g., MitM or compromised OBS/repository server); exploitation is conditional on the attacker's ability to change downloaded packages ↗
·Debian severity is scoped as 'local', meaning exploitation context may be considered local in some threat models despite the network-controlled path vector ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:P

osv9.8CRITICAL

vendor_debian7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.