SUSE-SU-2022:4351-1

Source
https://www.suse.com/support/update/announcement/2022/suse-su-20224351-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2022:4351-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2022:4351-1
Upstream
  • CVE-2019-3685
Related
Published
2022-12-07T16:38:34Z
Modified
2025-05-02T04:30:14.027340Z
Summary
Security update for osc
Details

This update for osc fixes the following issues:

osc was updated to version 0.182.0 (bsc#1154972, bsc#1144211, bsc#1142662, bsc#1140697, bsc#1138165):

  • Added MFA support (jsc#OBS-203).
  • CVE-2019-3681: Fixed vulnerability where osc stored downloaded RPMs in network controlled paths (bsc#1122675).
  • CVE-2019-3685: Fixed broken TLS certificate handling (bsc#1142518).

    Bugfixes:

  • Removed use of chardet to guess encoding. Utf-8 or latin-1 is now assumed, which will speed up decoding (bsc#1173926).
  • Added helper method htmlescape to enable python3.8 and python2.* compatibility (bsc#1166537).
  • Added MR creation to honor orev (bsc#1160446).
  • Fixed local build outside of the working copy of a package (bsc#1136584).
  • Don't enforce password reuse (bsc#1156501).
  • osc vc --file=foo bar.changes now writes the content from foo into bar.changes instead of creating a new file (bsc#1155953).
  • Fixed decoding on osc lbl (bsc#1137477).
  • Simplified and fixed osc meta -e (bsc#1138977).
  • osc lbl now works with non utf8 encoding (bsc#1129889).
  • Added full python3 compatibility (bsc#1125243, bsc#1131512, bsc#1129757).
  • Fixed slowdown of rbl with readline(bufsize) function (bsc#1127932).
  • Fixed osc build -p dir TypeError (bsc#1126055).
  • Fixed osc buildinfo -p TypeError (bsc#1126058).
  • Added new options --unexpand and --meta to diff command (bsc#1089025).
  • Fixed Requires to python-base which does not contain ssl.py (bsc#1097996).
References

Affected packages

SUSE:Linux Enterprise Software Development Kit 12 SP5 / osc

Package

Name
osc
Purl
pkg:rpm/suse/osc&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.182.0-15.12.1

Ecosystem specific

{
    "binaries": [
        {
            "osc": "0.182.0-15.12.1"
        }
    ]
}