CVE-2017-9274 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2017-9274 Interim 1 24 2023-12-09T01:04:00Z current 2021-05-30T13:57:09Z 2023-12-09T01:04:00Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2017-9274 A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2017-December/003487.html E-Mail link for SUSE-SU-2017:3253-1 https://lists.suse.com/pipermail/sle-security-updates/2018-January/003585.html E-Mail link for SUSE-SU-2018:0065-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4KHIAWOLS5XM4KFWPVHKZR254QJCDLPX/#4KHIAWOLS5XM4KFWPVHKZR254QJCDLPX E-Mail link for openSUSE-SU-2017:3259-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE CaaS Platform 4.5 SUSE Enterprise Storage 7 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise Real Time 15 SP2 SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise Server Business Critical Linux 15 SP1 SUSE Linux Enterprise Server Business Critical Linux 15 SP2 SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Manager Proxy 4.1 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Manager Retail Branch Server 4.1 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Manager Server 4.1 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 openSUSE Tumbleweed build build-20171128-8.3.3 build-20171128-9.3.2 build-initvm-s390-20171128-9.3.2 build-initvm-x86_64-20171128-9.3.2 build-mkbaselibs build-mkbaselibs-20171128-9.3.2 obs-service-source_validator-0.21-1.3 obs-service-source_validator-0.7-9.3.1 osc-0.162.0-15.3.1 osc-0.162.1-7.4.1 build-20171128-8.3.3 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 osc-0.162.1-7.4.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 build-20171128-9.3.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 build-initvm-s390-20171128-9.3.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 build-initvm-x86_64-20171128-9.3.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 build-mkbaselibs-20171128-9.3.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 obs-service-source_validator-0.7-9.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 osc-0.162.0-15.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 build-20171128-9.3.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 build-initvm-s390-20171128-9.3.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 build-initvm-x86_64-20171128-9.3.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 build-mkbaselibs-20171128-9.3.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 obs-service-source_validator-0.7-9.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 osc-0.162.0-15.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 obs-service-source_validator-0.7-9.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 build-20171128-9.3.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 build-initvm-s390-20171128-9.3.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 build-initvm-x86_64-20171128-9.3.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 build-mkbaselibs-20171128-9.3.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 obs-service-source_validator-0.7-9.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 osc-0.162.0-15.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 obs-service-source_validator-0.21-1.3 as a component of openSUSE Tumbleweed build as a component of SUSE CaaS Platform 4.5 build as a component of SUSE Enterprise Storage 7 build as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS build-mkbaselibs as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS build as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS build-mkbaselibs as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS build as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS build-mkbaselibs as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS build as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 build-mkbaselibs as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 build as a component of SUSE Linux Enterprise Module for Development Tools 15 SP4 build-mkbaselibs as a component of SUSE Linux Enterprise Module for Development Tools 15 SP4 build as a component of SUSE Linux Enterprise Real Time 15 SP2 build-mkbaselibs as a component of SUSE Linux Enterprise Real Time 15 SP2 build as a component of SUSE Linux Enterprise Server 15 SP2-LTSS build-mkbaselibs as a component of SUSE Linux Enterprise Server 15 SP2-LTSS build as a component of SUSE Linux Enterprise Server Business Critical Linux 15 SP1 build as a component of SUSE Linux Enterprise Server Business Critical Linux 15 SP2 build as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 build-mkbaselibs as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 build as a component of SUSE Manager Proxy 4.1 build as a component of SUSE Manager Retail Branch Server 4.1 build as a component of SUSE Manager Server 4.1 A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs. CVE-2017-9274 SUSE Linux Enterprise Software Development Kit 11 SP4:build-20171128-8.3.3 SUSE Linux Enterprise Software Development Kit 11 SP4:osc-0.162.1-7.4.1 SUSE Linux Enterprise Software Development Kit 12 SP2:build-20171128-9.3.2 SUSE Linux Enterprise Software Development Kit 12 SP2:build-initvm-s390-20171128-9.3.2 SUSE Linux Enterprise Software Development Kit 12 SP2:build-initvm-x86_64-20171128-9.3.2 SUSE Linux Enterprise Software Development Kit 12 SP2:build-mkbaselibs-20171128-9.3.2 SUSE Linux Enterprise Software Development Kit 12 SP2:obs-service-source_validator-0.7-9.3.1 SUSE Linux Enterprise Software Development Kit 12 SP2:osc-0.162.0-15.3.1 SUSE Linux Enterprise Software Development Kit 12 SP3:build-20171128-9.3.2 SUSE Linux Enterprise Software Development Kit 12 SP3:build-initvm-s390-20171128-9.3.2 SUSE Linux Enterprise Software Development Kit 12 SP3:build-initvm-x86_64-20171128-9.3.2 SUSE Linux Enterprise Software Development Kit 12 SP3:build-mkbaselibs-20171128-9.3.2 SUSE Linux Enterprise Software Development Kit 12 SP3:obs-service-source_validator-0.7-9.3.1 SUSE Linux Enterprise Software Development Kit 12 SP3:osc-0.162.0-15.3.1 SUSE Linux Enterprise Software Development Kit 12 SP4:obs-service-source_validator-0.7-9.3.1 SUSE Linux Enterprise Software Development Kit 12 SP5:build-20171128-9.3.2 SUSE Linux Enterprise Software Development Kit 12 SP5:build-initvm-s390-20171128-9.3.2 SUSE Linux Enterprise Software Development Kit 12 SP5:build-initvm-x86_64-20171128-9.3.2 SUSE Linux Enterprise Software Development Kit 12 SP5:build-mkbaselibs-20171128-9.3.2 SUSE Linux Enterprise Software Development Kit 12 SP5:obs-service-source_validator-0.7-9.3.1 SUSE Linux Enterprise Software Development Kit 12 SP5:osc-0.162.0-15.3.1 openSUSE Tumbleweed:obs-service-source_validator-0.21-1.3 SUSE CaaS Platform 4.5:build SUSE Enterprise Storage 7:build SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:build SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:build-mkbaselibs SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:build SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:build-mkbaselibs SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:build SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:build-mkbaselibs SUSE Linux Enterprise Module for Development Tools 15 SP3:build SUSE Linux Enterprise Module for Development Tools 15 SP3:build-mkbaselibs SUSE Linux Enterprise Module for Development Tools 15 SP4:build SUSE Linux Enterprise Module for Development Tools 15 SP4:build-mkbaselibs SUSE Linux Enterprise Real Time 15 SP2:build SUSE Linux Enterprise Real Time 15 SP2:build-mkbaselibs SUSE Linux Enterprise Server 15 SP2-LTSS:build SUSE Linux Enterprise Server 15 SP2-LTSS:build-mkbaselibs SUSE Linux Enterprise Server Business Critical Linux 15 SP1:build SUSE Linux Enterprise Server Business Critical Linux 15 SP2:build SUSE Linux Enterprise Server for SAP Applications 15 SP2:build SUSE Linux Enterprise Server for SAP Applications 15 SP2:build-mkbaselibs SUSE Manager Proxy 4.1:build SUSE Manager Retail Branch Server 4.1:build SUSE Manager Server 4.1:build important 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H