CVE-2019-3685 Missing TLS certificate validation for HTTPS connections in osc

High 7.4 Published 5 Nov 2019 Updated 16 Sep 2024

The osc client fails to validate TLS certificates, allowing attackers to intercept or modify data via man-in-the-middle attacks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-3685?

CVE-2019-3685 is a high-severity vulnerability in Open Build Service, published on 5 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary

Weakness: CWE-295

Which versions are affected by CVE-2019-3685?

It affects 1 product.

Linux distribution packages (2)

`osc` SUSE:Linux Enterprise Module for Development Tools 15 SP1	All versions	`0.165.4-3.9.1`
`osc` openSUSE:Leap 15.1	All versions	`0.165.4-lp151.2.6.1`

Products include Opensuse Open Build Service.

How do I fix CVE-2019-3685?

Upgrade to a fixed version.

Is CVE-2019-3685 being exploited?

There is no known exploitation of CVE-2019-3685 in the wild and no public exploit code.

Sources

Also known as GHSA-j9gx-ccw3-w6cf, SUSE-SU-2019:2067-1, UBUNTU-CVE-2019-3685, openSUSE-SU-2019:1844-1.