CVE-2024-22034

EUVD-2024-19638
Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
suseCNA
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 5%
Debian logo
Debian Releases
Debian Product
Codename
osc
bookworm
no-dsa
bullseye
postponed
forky
1.15.1-1
fixed
sid
1.15.1-1
fixed
trixie
1.12.1-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
osc
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
not-affected
questing
not-affected
xenial
needs-triage
References
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22034