CVE-2019-3681

CWE-737 documents6 sources
Severity
9.8CRITICAL
EPSS
0.9%
top 24.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Opensuse Opensuse FactoryOpensuse Opensuse Leap 15.1Suse Suse Linux Enterprise Module FOR Development Tools 15+3 more
Timeline
PublishedJun 29
Latest updateMay 24

Description

A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software …

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5opensuse/opensuse_factoryosc — 0.169.0
▶CVEListV5opensuse/opensuse_leap_15.1osc — 0.169.1-lp151.2.15.1

🔴Vulnerability Details

3
GHSA
GHSA-9w8p-3cm4-h4c7: A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software↗2022-05-24
▶
OSV
CVE-2019-3681: A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software↗2020-06-29
▶
CVEList
osc: stores downloaded (supposed) RPM in network-controlled filesystem paths↗2020-06-29
▶

📋Vendor Advisories

1
Debian
CVE-2019-3681: osc - A External Control of File Name or Path vulnerability in osc of SUSE Linux Enter...↗2019
▶

💬Community

2
Bugzilla
CVE-2019-3681 osc: Stores downloaded RPM in network-controlled filesystem paths [fedora-all]↗2020-09-16
▶
Bugzilla
CVE-2019-3681 osc: Stores downloaded RPM in network-controlled filesystem paths↗2020-09-16
▶
CVE-2019-3681 (CRITICAL CVSS 9.8) | A External Control of File Name or | cvebase.io