openSUSE-SU-2019:1844-1

    Dashboard / Vulnerabilities / openSUSE-SU-2019:1844-1

    openSUSE-SU-2019:1844-1

    Published: 12 Aug 2019Last Modified: 4 Feb 2026
    Upstream:
    CVE-2019-3685
    Aliases:
    CVE-2019-3685

    Summary: Security update for osc

    Details: This update for osc to version 0.165.4 fixes the following issues: Security issue fixed: - CVE-2019-3685: Fixed broken TLS certificate handling allowing for a Man-in-the-middle attack (bsc#1142518). Non-security issues fixed: - support different token operations (runservice, release and rebuild) (requires OBS 2.10) - fix osc token decode error - offline build mode is now really offline and does not try to download the buildconfig - osc build -define now works with python3 - fixes an issue where the error message on osc meta -e was not parsed correctly - osc maintainer -s now works with python3 - simplified and fixed osc meta -e (bsc#1138977) - osc lbl now works with non utf8 encoding (bsc#1129889) - add simpleimage as local build type - allow optional fork when creating a maintenance request - fix RPMError fallback - fix local caching for all package formats - fix appname for trusted cert store - osc -h does not break anymore when using plugins - switch to difflib.diff_bytes and sys.stdout.buffer.write for diffing. This will fix all decoding issues with osc diff, osc ci and osc rq -d - fix osc ls -lb handling empty size and mtime - removed decoding on osc api command. This update was imported from the SUSE:SLE-15-SP1:Update update project.

    References: https://lists.opensuse.org/archives/list/[email protected]/thread/M2AIZJVEMKESSHPXKBTNWAXKY4GTXTFO/#M2AIZJVEMKESSHPXKBTNWAXKY4GTXTFO, https://bugzilla.suse.com/1129889, https://bugzilla.suse.com/1138977, https://bugzilla.suse.com/1140697, https://bugzilla.suse.com/1142518, https://bugzilla.suse.com/1142662, https://bugzilla.suse.com/1144211, https://www.suse.com/security/cve/CVE-2019-3685

    Affected packages

    Package

    Name: osc

    Purl: pkg:rpm/opensuse/osc&distro=openSUSE%20Leap%2015.1

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -0.165.4-lp151.2.6.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    openSUSE-SU-2019:1844-1 | CVE-DB