Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1533743 (CVE-2017-9274) - CVE-2017-9274 osc: Macro expansion can lead to arbitray code execution
Summary: CVE-2017-9274 osc: Macro expansion can lead to arbitray code execution
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-9274
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1533744 1533745
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-01-12 06:10 UTC by Sam Fowler
Modified: 2019-09-29 14:29 UTC (History)
3 users (show)

Fixed In Version: osc 0.162 obs-service-source_validator 0.7
Clone Of:
Environment:
Last Closed: 2018-01-17 13:22:08 UTC
Embargoed:

Attachments (Terms of Use)

Description Sam Fowler 2018-01-12 06:10:10 UTC 
osc before version 0.162 and obs-service-source_validator before version 0.7 are vulnerable arbitrary code during macro expansion.

References:
https://bugzilla.novell.com/show_bug.cgi?id=938556
Comment 1 Sam Fowler 2018-01-12 06:10:37 UTC 
Created osc tracking bugs for this issue:

Affects: fedora-all [bug 1533745]


Created osc-source_validator tracking bugs for this issue:

Affects: fedora-all [bug 1533744]
Comment 2 Neal Gompa 2018-01-17 13:22:08 UTC 
Fixed in Fedora 26 and Fedora 27 as updates.
Note You need to log in before you can comment on or make changes to this bug.