{"affected":[{"ecosystem_specific":{"binaries":[{"build":"20171128-9.3.2","build-initvm-s390":"20171128-9.3.2","build-initvm-x86_64":"20171128-9.3.2","build-mkbaselibs":"20171128-9.3.2","obs-service-source_validator":"0.7-9.3.1","osc":"0.162.0-15.3.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","name":"build","purl":"pkg:rpm/suse/build&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"20171128-9.3.2"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"build":"20171128-9.3.2","build-initvm-s390":"20171128-9.3.2","build-initvm-x86_64":"20171128-9.3.2","build-mkbaselibs":"20171128-9.3.2","obs-service-source_validator":"0.7-9.3.1","osc":"0.162.0-15.3.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","name":"obs-service-source_validator","purl":"pkg:rpm/suse/obs-service-source_validator&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.7-9.3.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"build":"20171128-9.3.2","build-initvm-s390":"20171128-9.3.2","build-initvm-x86_64":"20171128-9.3.2","build-mkbaselibs":"20171128-9.3.2","obs-service-source_validator":"0.7-9.3.1","osc":"0.162.0-15.3.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","name":"osc","purl":"pkg:rpm/suse/osc&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.162.0-15.3.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"build":"20171128-9.3.2","build-initvm-s390":"20171128-9.3.2","build-initvm-x86_64":"20171128-9.3.2","build-mkbaselibs":"20171128-9.3.2","obs-service-source_validator":"0.7-9.3.1","osc":"0.162.0-15.3.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","name":"build","purl":"pkg:rpm/suse/build&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"20171128-9.3.2"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"build":"20171128-9.3.2","build-initvm-s390":"20171128-9.3.2","build-initvm-x86_64":"20171128-9.3.2","build-mkbaselibs":"20171128-9.3.2","obs-service-source_validator":"0.7-9.3.1","osc":"0.162.0-15.3.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","name":"obs-service-source_validator","purl":"pkg:rpm/suse/obs-service-source_validator&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.7-9.3.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"build":"20171128-9.3.2","build-initvm-s390":"20171128-9.3.2","build-initvm-x86_64":"20171128-9.3.2","build-mkbaselibs":"20171128-9.3.2","obs-service-source_validator":"0.7-9.3.1","osc":"0.162.0-15.3.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","name":"osc","purl":"pkg:rpm/suse/osc&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.162.0-15.3.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This OBS toolchain update fixes the following issues:\n\nPackage 'build':\n\n- CVE-2010-4226: force use of bsdtar for VMs (bnc#665768)\n- CVE-2017-14804: Improve file name check extractbuild (bsc#1069904)\n- switch baselibs scheme for debuginfo packages from foo-debuginfo-32bit to foo-32bit-debuginfo (fate#323217)\n\nPackage 'obs-service-source_validator':\n- CVE-2017-9274: Don't use rpmbuild to extract sources, patches etc. from a spec (bnc#938556).\n- Update to version 0.7\n- use spec_query instead of output_versions using the specfile parser from the build package (boo#1059858)\n\nPackage 'osc':\n- update to version 0.162.0\n- add Recommends: ca-certificates to enable TLS verification without manually installing them. (bnc#1061500)\n","id":"SUSE-SU-2017:3253-1","modified":"2017-12-08T12:54:18Z","published":"2017-12-08T12:54:18Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173253-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1059858"},{"type":"REPORT","url":"https://bugzilla.suse.com/1061500"},{"type":"REPORT","url":"https://bugzilla.suse.com/1069904"},{"type":"REPORT","url":"https://bugzilla.suse.com/665768"},{"type":"REPORT","url":"https://bugzilla.suse.com/938556"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2010-4226"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-14804"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-9274"}],"related":["CVE-2010-4226","CVE-2017-14804","CVE-2017-9274"],"summary":"Fixing security issues on OBS toolchain","upstream":["CVE-2010-4226","CVE-2017-14804","CVE-2017-9274"]}