{"document":{"aggregate_severity":{"namespace":"https://www.suse.com/support/security/rating/","text":"moderate"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"text":"Copyright 2024 SUSE LLC. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"summary","text":"Security update for osc","title":"Title of the patch"},{"category":"description","text":"This update for osc fixes the following issues:\n\n- 1.9.0\n  - Security:\n    - Fix possibility to overwrite special files in .osc (CVE-2024-22034 bsc#1225911)\n      Source files are now stored in the 'sources' subdirectory which prevents\n      name collisons. This requires changing version of '.osc' store to 2.0.\n  - Command-line:\n    - Introduce build --checks parameter\n  - Library:\n    - OscConfigParser: Remove automatic __name__ option\n\n- 1.8.3\n  - Command-line:\n    - Change 'repairwc' command to always run all repair steps\n  - Library:\n    - Make most of the fields in KeyinfoPubkey and KeyinfoSslcert models optional\n    - Fix colorize() to avoid wrapping empty string into color escape sequences\n    - Provide default values for kwargs.get/pop in get_results() function\n\n- 1.8.2\n  - Library:\n    - Change 'repairwc' command to fix missing .osc/_osclib_version\n    - Make error message in check_store_version() more generic to work for both projects and packages\n    - Fix check_store_version in project store\n\n- 1.8.1\n  - Command-line:\n    - Fix 'linkpac' command crash when used with '--disable-build' or '--disable-publish' option\n\n- 1.8.0\n  - Command-line:\n    - Improve 'submitrequest' command to inherit description from superseded request\n    - Fix 'mv' command when renaming a file multiple times\n    - Improve 'info' command to support projects\n    - Improve 'getbinaries' command by accepting '-M' / '--multibuild-package' option outside checkouts\n    - Add architecture filtering to 'release' command\n    - Change 'results' command so the normal and multibuild packages have the same output\n    - Change 'results' command to use csv writer instead of formatting csv as string\n    - Add couple mutually exclusive options errors to 'results' command\n    - Set a default value for 'results --format' only for the csv output\n    - Add support for 'results --format' for the default text mode\n    - Update help text for '--format' option in 'results' command\n    - Add 'results --fail-on-error/-F' flag\n    - Redirect venv warnings from stderr to debug output\n  - Configuration:\n    - Fix config parser to throw an exception on duplicate sections or options\n    - Modify conf.get_config() to print permissions warning to stderr rather than stdout\n  - Library:\n    - Run check_store_version() in obs_scm.Store and fix related code in Project and Package\n    - Forbid extracting files with absolute path from 'cpio' archives (bsc#1122683)\n    - Forbid extracting files with absolute path from 'ar' archives (bsc#1122683)\n    - Remove no longer valid warning from core.unpack_srcrpm()\n    - Make obs_api.KeyinfoSslcert keyid and fingerprint fields optional\n    - Fix return value in build build.create_build_descr_data()\n    - Fix core.get_package_results() to obey 'multibuild_packages' argument\n  - Tests:\n    - Fix tests so they don't modify fixtures\n\n- 1.7.0\n  - Command-line:\n    - Add 'person search' command\n    - Add 'person register' command\n    - Add '-M/--multibuild-package' option to '[what]dependson' commands\n    - Update '-U/--user' option in 'maintainer' command to accept also an email address\n    - Fix 'branch' command to allow using '--new-package' option on packages that do not exist\n    - Fix 'buildinfo' command to include obs:cli_debug_packages by default\n    - Fix 'buildinfo' command to send complete local build environment as the 'build' command does\n    - Fix 'maintainer --devel-project' to raise an error if running outside a working copy without any arguments\n    - Fix handling arguments in 'service remoterun prj/pac'\n    - Fix 'rebuild' command so the '--all' option conflicts with the 'package' argument\n    - Fix crash when removing 'scmsync' element from dst package meta in 'linkpac' command\n    - Fix crash when reading dst package meta in 'linkpac' command\n    - Allow `osc rpmlint` to infer prj/pkg from CWD\n    - Propagate exit code from the run() and do_() commandline methods\n    - Give a hint where a scmsync git is hosted\n    - Fix crash in 'updatepacmetafromspec' command when working with an incomplete spec\n    - Improve 'updatepacmetafromspec' command to expand rpm spec macros by calling rpmspec to query the data\n    - Improve 'build' and 'buildinfo' commands by uploading *.inc files to OBS for parsing BuildRequires (bsc#1221340)\n    - Improve 'service' command by printing names of running services\n    - Improve 'getbinaries' command by ignoring source and debuginfo filters when a binary name is specified\n    - Change 'build' command to pass '--jobs' option to 'build' tool only if 'build_jobs' > 0\n    - Clarify 'list' command's help that that listing binaries doesn't contain md5 checksums\n    - Improve 'log' command: produce proper CSV and XML outputs, add -p/--patch option for the text output\n    - Allow setlinkrev to set a specific vrev\n    - Document '--buildtool-opt=--noclean' example in 'build' command's help\n    - Fix handling the default package argument on the command-line\n  - Configuration:\n    - Document loading configuration from env variables\n  - Connection:\n    - Don't retry on error 400\n    - Remove now unused 'retry_on_400' http_request() option from XmlModel\n    - Revert 'Don't retry on 400 HTTP status code in core.server_diff()'\n    - Revert 'connection: Allow disabling retry on 400 HTTP status code'\n  - Authentication:\n    - Update SignatureAuthHandler to support specifying ssh key by its fingerprint\n    - Use ssh key from ssh agent that contains comment 'obs=<apiurl-hostname>'\n    - Use strings instead of bytes in SignatureAuthHandler\n    - Cache password from SecretService to avoid spamming user with an accept dialog\n    - Never ask for credentials when displaying help\n    - Remove unused SignatureAuthHandler.get_fingerprint()\n  - Library:\n    - Add rootless build support for 'qemu' VM type\n    - Support package linking of packages from scmsync projects\n    - Fix do_createrequest() function to return None instead of request id\n    - Replace invalid 'if' with 'elif' in BaseModel.dict()\n    - Fix crash when no prefered packages are defined\n    - Add XmlModel class that encapsulates manipulation with XML\n    - Add obs_api.Person.cmd_register() for registering new users\n    - Fix conf.get_config() to ignore file type bits when comparing oscrc perms\n    - Fix conf.get_config() to correctly handle overrides when env variables are set\n    - Fix output.tty.IS_INTERACTIVE when os.isatty() throws OSError\n    - Improve cmdln.HelpFormatter to obey newline characters\n    - Update list of color codes in 'output.tty' module\n    - Remove core.setDevelProject() in favor of core.set_devel_project()\n    - Move removing control characters to output.sanitize_text()\n    - Improve sanitize_text() to keep selected CSI escape sequences\n    - Add output.pipe_to_pager() that pipes lines to a pager without creating an intermediate temporary file\n    - Fix output.safe_write() in connection with NamedTemporaryFile\n    - Modernize output.run_pager()\n    - Extend output.print_msg() to accept 'error' and 'warning' values of 'to_print' argument\n    - Add XPathQuery class for translating keyword arguments to an xpath query\n    - Add obs_api.Keyinfo class\n    - Add obs_api.Package class\n    - Add Package.get_revision_list() for listing commit log\n    - Add obs_api.PackageSources class for handling OBS SCM sources\n    - Add obs_api.Person class\n    - Add obs_api.Project class\n    - Add obs_api.Request class\n    - Add obs_api.Token class\n    - Allow storing apiurl in the XmlModel instances\n    - Allow retrieving default field value from top-level model\n    - Fix BaseModel to convert dictionaries to objects on retrieving a model list\n    - Fix BaseModel to always deepcopy mutable defaults on first use\n    - Implement do_snapshot() and has_changed() methods to determine changes in BaseModel\n    - Implement total ordering on BaseModel\n    - Add comments with available attributes/elements to edited XML\n  - Refactoring:\n    - Migrate repo {list,add,remove} commands to obs_api.Project\n    - Migrate core.show_package_disabled_repos() to obs_api.Package\n    - Migrate core.Package.update_package_meta() to obs_api.Package\n    - Migrate core.get_repos_of_project() to obs_api.Project\n    - Migrate core.get_repositories_of_project() to obs_api.Project\n    - Migrate core.show_scmsync() to obs_api.{Package,Project}\n    - Migrate core.set_devel_project() to obs_api.Package\n    - Migrate core.show_devel_project() to obs_api.Package\n    - Migrate Fetcher.run() to obs_api.Keyinfo\n    - Migrate core.create_submit_request() to obs_api.Request\n    - Migrate 'token' command to obs_api.Token\n    - Migrate 'whois/user' command to obs_api.Person\n    - Migrate 'signkey' command to obs_api.Keyinfo\n    - Move print_msg() to the 'osc.output' module\n    - Move run_pager() and get_default_pager() from 'core' to 'output' module\n    - Move core.Package to obs_scm.Package\n    - Move core.Project to obs_scm.Project\n    - Move functions manipulating store from core to obs_scm.store\n    - Move store.Store to obs_scm.Store\n    - Move core.Linkinfo to obs_scm.Linkinfo\n    - Move core.Serviceinfo to obs_scm.Serviceinfo\n    - Move core.File to obs_scm.File\n    - Merge _private.project.ProjectMeta into obs_api.Project\n  - Spec:\n    - Remove dependency on /usr/bin/python3 using %python3_fix_shebang macro (bsc#1212476)\n\n- 1.6.2\n  - Command-line:\n    - Fix 'branch' command to allow using '--new-package' option on packages that do not exist\n    - Fix 'buildinfo' command to include obs:cli_debug_packages by default\n    - Fix 'buildinfo' command to send complete local build environment as the 'build' command does\n    - Allow `osc rpmlint` to infer prj/pkg from CWD\n    - Propagate exit code from the run() and do_() commandline methods\n    - Give a hint where a scmsync git is hosted\n    - Fix crash in 'updatepacmetafromspec' command when working with an incomplete spec\n  - Authentication:\n    - Cache password from SecretService to avoid spamming user with an accept dialog\n    - Never ask for credentials when displaying help\n  - Library:\n    - Support package linking of packages from scmsync projects\n    - Fix do_createrequest() function to return None instead of request id\n    - Replace invalid 'if' with 'elif' in BaseModel.dict()\n    - Fix crash when no prefered packages are defined\n\n- 1.6.1\n  - Command-line:\n    - Use busybox compatible commands for completion\n    - Change 'wipe' command to use the new get_user_input() function\n    - Fix error 500 in running 'meta attribute <prj>'\n  - Configuration:\n    - Fix resolving config symlink to the actual config file\n    - Honor XDG_CONFIG_HOME and XDG_CACHE_HOME env vars\n    - Warn about ignoring XDG_CONFIG_HOME and ~/.config/osc/oscrc if ~/.oscrc exists\n  - Library:\n    - Error out when branching a scmsync package\n    - New get_user_input() function for consistent handling of user input\n    - Move xml_indent, xml_quote and xml_unquote to osc.util.xml module\n    - Refactor makeurl(), deprecate query taking string or list arguments, drop osc_urlencode()\n    - Remove all path quoting, rely on makeurl()\n    - Always use dict query in makeurl()\n    - Fix core.slash_split() to strip both leading and trailing slashes\n\n- 1.6.0\n  - Command-line:\n    - The 'token --trigger' command no longer sets '--operation=runservice' by default.\n    - Change 'token --create' command to require '--operation'\n    - Fix 'linkdiff' command error 400: prj/pac/md5 not in repository\n    - Update 'build' command to support building 'productcompose' build type with updateinfo.xml data\n    - Don't show meter in terminals that are not interactive\n    - Fix traceback when running osc from an arbitrary git repo that fails to map branch to a project (bsc#1218170)\n  - Configuration:\n    - Implement reading credentials from environmental variables\n    - Allow starting with an empty config if --configfile is either empty or points to /dev/null\n    - Implement 'quiet' conf option\n    - Password can be an empty string (commonly used with ssh auth)\n  - Connection:\n    - Allow -X HEAD on osc api requests as well\n  - Library:\n    - Fix credentials managers to consistently return Password\n    - Fix Password.encode() on python < 3.8\n    - Refactor 'meter' module, use config settings to pick the right class\n    - Convert to using f-strings\n    - Use Field.get_callback to handle quiet/verbose and http_debug/http_full_debug options\n    - Implement get_callback that allows modifying returned value to the Field class\n    - Add support for List[BaseModel] type to Field class\n    - Report class name when reporting an error during instantiating BaseModel object\n    - Fix exporting an empty model field in  BaseModel.dict()\n    - Fix initializing a sub-model instance from a dictionary\n    - Implement 'Enum' support in models\n    - Fix Field.origin_type for Optional types\n    - Drop unused 'exclude_unset' argument from BaseModel.dict() method\n    - Store cached model defaults in self._defaults, avoid sharing references to mutable defaults\n    - Limit model attributes to predefined fields by forbidding creating new attributes on fly\n    - Store model values in self._values dict instead of private attributes\n  - Spec:\n    - Recommend openssh-clients for ssh-add that is required during ssh auth\n    - Add 0%{?amzn} macro that wasn't usptreamed\n","title":"Description of the patch"},{"category":"details","text":"SUSE-2024-2961,SUSE-SLE-Module-Development-Tools-15-SP5-2024-2961,SUSE-SLE-Module-Development-Tools-15-SP6-2024-2961,openSUSE-SLE-15.5-2024-2961,openSUSE-SLE-15.6-2024-2961","title":"Patchnames"},{"category":"legal_disclaimer","text":"CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).","title":"Terms of use"}],"publisher":{"category":"vendor","contact_details":"https://www.suse.com/support/security/contact/","name":"SUSE Product Security Team","namespace":"https://www.suse.com/"},"references":[{"category":"external","summary":"SUSE ratings","url":"https://www.suse.com/support/security/rating/"},{"category":"self","summary":"URL of this CSAF notice","url":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_2961-1.json"},{"category":"self","summary":"URL for SUSE-SU-2024:2961-1","url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242961-1/"},{"category":"self","summary":"E-Mail link for SUSE-SU-2024:2961-1","url":"https://lists.suse.com/pipermail/sle-updates/2024-August/036632.html"},{"category":"self","summary":"SUSE Bug 1122683","url":"https://bugzilla.suse.com/1122683"},{"category":"self","summary":"SUSE Bug 1212476","url":"https://bugzilla.suse.com/1212476"},{"category":"self","summary":"SUSE Bug 1218170","url":"https://bugzilla.suse.com/1218170"},{"category":"self","summary":"SUSE Bug 1221340","url":"https://bugzilla.suse.com/1221340"},{"category":"self","summary":"SUSE Bug 1225911","url":"https://bugzilla.suse.com/1225911"},{"category":"self","summary":"SUSE CVE CVE-2024-22034 page","url":"https://www.suse.com/security/cve/CVE-2024-22034/"}],"title":"Security update for osc","tracking":{"current_release_date":"2024-08-19T12:06:41Z","generator":{"date":"2024-08-19T12:06:41Z","engine":{"name":"cve-database.git:bin/generate-csaf.pl","version":"1"}},"id":"SUSE-SU-2024:2961-1","initial_release_date":"2024-08-19T12:06:41Z","revision_history":[{"date":"2024-08-19T12:06:41Z","number":"1","summary":"Current version"}],"status":"final","version":"1"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"osc-1.9.0-150400.10.6.1.noarch","product":{"name":"osc-1.9.0-150400.10.6.1.noarch","product_id":"osc-1.9.0-150400.10.6.1.noarch"}}],"category":"architecture","name":"noarch"},{"branches":[{"category":"product_name","name":"SUSE Linux Enterprise Module for Development Tools 15 SP5","product":{"name":"SUSE Linux Enterprise Module for Development Tools 15 SP5","product_id":"SUSE Linux Enterprise Module for Development Tools 15 SP5","product_identification_helper":{"cpe":"cpe:/o:suse:sle-module-development-tools:15:sp5"}}},{"category":"product_name","name":"SUSE Linux Enterprise Module for Development Tools 15 SP6","product":{"name":"SUSE Linux Enterprise Module for Development Tools 15 SP6","product_id":"SUSE Linux Enterprise Module for Development Tools 15 SP6","product_identification_helper":{"cpe":"cpe:/o:suse:sle-module-development-tools:15:sp6"}}},{"category":"product_name","name":"openSUSE Leap 15.5","product":{"name":"openSUSE Leap 15.5","product_id":"openSUSE Leap 15.5","product_identification_helper":{"cpe":"cpe:/o:opensuse:leap:15.5"}}},{"category":"product_name","name":"openSUSE Leap 15.6","product":{"name":"openSUSE Leap 15.6","product_id":"openSUSE Leap 15.6","product_identification_helper":{"cpe":"cpe:/o:opensuse:leap:15.6"}}}],"category":"product_family","name":"SUSE Linux Enterprise"}],"category":"vendor","name":"SUSE"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"osc-1.9.0-150400.10.6.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP5","product_id":"SUSE Linux Enterprise Module for Development Tools 15 SP5:osc-1.9.0-150400.10.6.1.noarch"},"product_reference":"osc-1.9.0-150400.10.6.1.noarch","relates_to_product_reference":"SUSE Linux Enterprise Module for Development Tools 15 SP5"},{"category":"default_component_of","full_product_name":{"name":"osc-1.9.0-150400.10.6.1.noarch as component of SUSE Linux Enterprise Module for Development Tools 15 SP6","product_id":"SUSE Linux Enterprise Module for Development Tools 15 SP6:osc-1.9.0-150400.10.6.1.noarch"},"product_reference":"osc-1.9.0-150400.10.6.1.noarch","relates_to_product_reference":"SUSE Linux Enterprise Module for Development Tools 15 SP6"},{"category":"default_component_of","full_product_name":{"name":"osc-1.9.0-150400.10.6.1.noarch as component of openSUSE Leap 15.5","product_id":"openSUSE Leap 15.5:osc-1.9.0-150400.10.6.1.noarch"},"product_reference":"osc-1.9.0-150400.10.6.1.noarch","relates_to_product_reference":"openSUSE Leap 15.5"},{"category":"default_component_of","full_product_name":{"name":"osc-1.9.0-150400.10.6.1.noarch as component of openSUSE Leap 15.6","product_id":"openSUSE Leap 15.6:osc-1.9.0-150400.10.6.1.noarch"},"product_reference":"osc-1.9.0-150400.10.6.1.noarch","relates_to_product_reference":"openSUSE Leap 15.6"}]},"vulnerabilities":[{"cve":"CVE-2024-22034","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2024-22034"}],"notes":[{"category":"general","text":"Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim","title":"CVE description"}],"product_status":{"recommended":["SUSE Linux Enterprise Module for Development Tools 15 SP5:osc-1.9.0-150400.10.6.1.noarch","SUSE Linux Enterprise Module for Development Tools 15 SP6:osc-1.9.0-150400.10.6.1.noarch","openSUSE Leap 15.5:osc-1.9.0-150400.10.6.1.noarch","openSUSE Leap 15.6:osc-1.9.0-150400.10.6.1.noarch"]},"references":[{"category":"external","summary":"CVE-2024-22034","url":"https://www.suse.com/security/cve/CVE-2024-22034"},{"category":"external","summary":"SUSE Bug 1225911 for CVE-2024-22034","url":"https://bugzilla.suse.com/1225911"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Linux Enterprise Module for Development Tools 15 SP5:osc-1.9.0-150400.10.6.1.noarch","SUSE Linux Enterprise Module for Development Tools 15 SP6:osc-1.9.0-150400.10.6.1.noarch","openSUSE Leap 15.5:osc-1.9.0-150400.10.6.1.noarch","openSUSE Leap 15.6:osc-1.9.0-150400.10.6.1.noarch"]}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"products":["SUSE Linux Enterprise Module for Development Tools 15 SP5:osc-1.9.0-150400.10.6.1.noarch","SUSE Linux Enterprise Module for Development Tools 15 SP6:osc-1.9.0-150400.10.6.1.noarch","openSUSE Leap 15.5:osc-1.9.0-150400.10.6.1.noarch","openSUSE Leap 15.6:osc-1.9.0-150400.10.6.1.noarch"]}],"threats":[{"category":"impact","date":"2024-08-19T12:06:41Z","details":"moderate"}],"title":"CVE-2024-22034"}]}