CVE-2018-7689

NameCVE-2018-7689
DescriptionLack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs903797

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
open-build-service (PTS)bookworm2.9.4-9fixed
sid2.9.4-10fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
open-build-servicesource(unstable)2.9.4-1low903797

Notes

[stretch] - open-build-service <no-dsa> (Minor issue)
https://bugzilla.suse.com/show_bug.cgi?id=1094819
https://github.com/openSUSE/open-build-service/commit/990ef7cccef6f38fc1d1a1bb22a08e174dcba43b
Search for package or bug name: Reporting problems