From 41556ffd79f3668f2806aab4ec9cbf465b94542c Mon Sep 17 00:00:00 2001 From: Johannes Segitz Date: Mon, 29 Jun 2020 13:56:30 +0200 Subject: [PATCH] data for CVE-2019-3681 --- 2019/3xxx/CVE-2019-3681.json | 141 ++++++++++++++++++++++++++++++++++- 1 file changed, 138 insertions(+), 3 deletions(-) diff --git a/2019/3xxx/CVE-2019-3681.json b/2019/3xxx/CVE-2019-3681.json index 4f46a13c009..9b684221264 100644 --- a/2019/3xxx/CVE-2019-3681.json +++ b/2019/3xxx/CVE-2019-3681.json @@ -1,9 +1,97 @@ { "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", + "ASSIGNER": "security@suse.de", + "DATE_PUBLIC": "2020-05-27T00:00:00.000Z", "ID": "CVE-2019-3681", - "STATE": "RESERVED" + "STATE": "PUBLIC", + "TITLE": "osc: stores downloaded (supposed) RPM in network-controlled filesystem paths" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "SUSE Linux Enterprise Module for Development Tools 15", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "osc", + "version_value": "0.169.1-3.20.1" + } + ] + } + }, + { + "product_name": "SUSE Linux Enterprise Software Development Kit 12-SP5", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "osc", + "version_value": "0.162.1-15.9.1" + } + ] + } + }, + { + "product_name": "SUSE Linux Enterprise Software Development Kit 12-SP4", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "osc", + "version_value": "0.162.1-15.9.1" + } + ] + } + } + ] + }, + "vendor_name": "SUSE" + }, + { + "product": { + "product_data": [ + { + "product_name": "openSUSE Leap 15.1", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "osc", + "version_value": "0.169.1-lp151.2.15.1" + } + ] + } + }, + { + "product_name": "openSUSE Factory", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "osc", + "version_value": "0.169.0 " + } + ] + } + } + ] + }, + "vendor_name": "openSUSE" + } + ] + } + }, + "credit": [ + { + "lang": "eng", + "value": "Malte Kraus of SUSE" + } + ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", @@ -11,8 +99,55 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files.\nThis issue affects:\nSUSE Linux Enterprise Module for Development Tools 15\nosc versions prior to 0.169.1-3.20.1.\nSUSE Linux Enterprise Software Development Kit 12-SP5\nosc versions prior to 0.162.1-15.9.1.\nSUSE Linux Enterprise Software Development Kit 12-SP4\nosc versions prior to 0.162.1-15.9.1.\nopenSUSE Leap 15.1\nosc versions prior to 0.169.1-lp151.2.15.1.\nopenSUSE Factory\nosc versions prior to 0.169.0 ." } ] + }, + "generator": { + "engine": "Vulnogram 0.0.9" + }, + "impact": { + "cvss": { + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", + "version": "3.1" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-73: External Control of File Name or Path" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://bugzilla.suse.com/show_bug.cgi?id=1122675", + "refsource": "CONFIRM", + "url": "https://bugzilla.suse.com/show_bug.cgi?id=1122675" + } + ] + }, + "source": { + "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1122675", + "defect": [ + "1122675" + ], + "discovery": "INTERNAL" } } \ No newline at end of file