Shell Command Injection Vulnerability in osc Package
Summary
CVE-2017-9274: A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs. Affects osc across 2 version ranges.
< 0.162.1-1
< 1e990f00f4a78d58f1c4252f52ce63c48747f08a
Fixed in 0.162.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The osc (Open Build Service Command Line Client) package is a tool used for interacting with the Open Build Service, enabling users to manage and build software packages. It provides functionalities such as submitting packages, managing repositories, and handling build requests. However, prior to version 0.162.1-1, osc was found to be vulnerable to a shell command injection in the obs-service-source_validator, which could allow malicious users to execute arbitrary code during the validation of RPM SPEC files.
Vulnerability Detail
The vulnerability, identified as CVE-2017-9274, originates from a flaw in the obs-service-source_validator component of the osc package. This flaw allows an attacker to craft specific macro constructs within RPM SPEC files that, when processed, can lead to the execution of arbitrary shell commands. The ramifications of this vulnerability are severe, as it could enable an attacker to execute code with the privileges of the packager, potentially compromising the integrity of the system and leading to unauthorized access or data manipulation.
How To Fix
Minimum fixed version
0.162.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade oscTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the obs-service-source_validator for RPM SPEC files that contain complex macro constructs until they can upgrade to the fixed version. Additionally, reviewing and sanitizing SPEC files before processing them may help mitigate the risk.
Conclusion
CVE-2017-9274 represents a significant security vulnerability in the osc package, allowing for potential code execution through shell command injection. Users are strongly advised to upgrade to the latest version to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for osc →
FAQ
CVE-2017-9274 is a vulnerability in the osc package that allows for shell command injection through specific macro constructs in RPM SPEC files.
The vulnerability can lead to arbitrary code execution with the privileges of the packager, posing significant security risks to the system.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score for CVE-2017-9274 is 7.8, indicating a high severity level.
You can upgrade the osc package by running the command: sudo apt-get update && sudo apt-get install osc on your Debian-based system.
Related vulnerabilities
Recent vulnerabilities recorded for osc.
