6.3
Medium
CVE-2024-22033 The OBS service obs-service-download_url was vulnerable to a command injection vulnerability
Description
The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SUSE Package Hub 15 SP5 0.2 | earliest → < 0.2.1-bp155.3.3.1 | 0.2.1-bp155.3.3.1 |
| SUSE Package Hub 15 SP6 0.2 | earliest → < 0.2.1-bp156.2.3.1 | 0.2.1-bp156.2.3.1 |
| openSUSE Leap 15.5 0.2 | earliest → < 0.2.1-bp155.3.3.1 | 0.2.1-bp155.3.3.1 |
| openSUSE Leap 15.6 0.2 | earliest → < 0.2.1-bp156.2.3.1 | 0.2.1-bp156.2.3.1 |
| openSUSE Tumbleweed 0.2 | earliest → < 0.2.1-1.1 | 0.2.1-1.1 |
References
- bugzilla.suse.com bugzilla.suse.com
Timeline
- Published
- Last modified