CVE catalog

CVE-2014-0594

open-build-service: CVE-2014-0594

[CVE catalog]

Severity
Low
Source
[NVD] · [CVE record]
EPSS
0.83% · Oct 25, 2026

In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopen-build-servicesid2.9.4-13not affected
Debianopen-build-servicebookworm2.9.4-9not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopen-build-servicesourcesidNot affectedunimportantNot reportedNot reported
Debianopen-build-servicesourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [obs-productconverter]Not affected

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Not affected

      dsa · open-build-service · debian · bookworm

    • 2.9.4-9 · all · bookworm

      Not affected

      dsa · open-build-service · debian · bookworm

  • [obs-server]Not affected

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Not affected

      dsa · open-build-service · debian · bookworm

    • 2.9.4-9 · all · bookworm

      Not affected

      dsa · open-build-service · debian · bookworm

  • [obs-utils]Not affected

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Not affected

      dsa · open-build-service · debian · bookworm

    • 2.9.4-9 · all · bookworm

      Not affected

      dsa · open-build-service · debian · bookworm

  • [obs-worker]Not affected

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Not affected

      dsa · open-build-service · debian · bookworm

    • 2.9.4-9 · all · bookworm

      Not affected

      dsa · open-build-service · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS]