CVE-2019-3681 osc: stores downloaded (supposed) RPM in network-controlled filesystem paths
Remote attackers can overwrite arbitrary files by manipulating downloaded RPM paths in the SUSE osc tool.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-3681?
CVE-2019-3681 is a high-severity path traversal vulnerability in SUSE Linux Enterprise Module for Development Tools 15, published on 29 Jun 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc versions prior to 0.169.0 .
Weakness: CWE-73
Which versions are affected by CVE-2019-3681?
It affects 1 product.
Linux distribution packages (5)
osc SUSE:Linux Enterprise Module for Development Tools 15 SP1 | All versions | 0.169.1-3.20.1 |
osc SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 0.169.1-3.20.1 |
osc SUSE:Linux Enterprise Software Development Kit 12 SP4 | All versions | 0.162.1-15.9.1 |
osc SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 0.162.1-15.9.1 |
osc openSUSE:Leap 15.1 | All versions | 0.169.1-lp151.2.15.1 |
Products include Opensuse Osc.
How do I fix CVE-2019-3681?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-3681 being exploited?
There is no known exploitation of CVE-2019-3681 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2019-3681, GHSA-9w8p-3cm4-h4c7, SUSE-SU-2020:1528-1, SUSE-SU-2020:1695-1, SUSE-SU-2020:1695-2, UBUNTU-CVE-2019-3681 and 1 more.