CVE catalog

CVE-2017-9268

open-build-service: CVE-2017-9268

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.60% · Oct 25, 2026

In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of service (resource consumption).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopen-build-servicesid2.9.4-13fixed
Debianopen-build-servicebookworm2.9.4-9fixed
Ubuntuopen-build-service18.042.7.4-2vulnerable
Ubuntuopen-build-service24.042.9.4-9vulnerable
Ubuntuopen-build-service24.042.9.4-10vulnerable
Ubuntuopen-build-service25.102.9.4-10vulnerable
Ubuntuopen-build-service26.042.9.4-10vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopen-build-servicesourcesid2.9.4-1lowNot reportedNot reported
Debianopen-build-servicesourcebookworm2.9.4-1lowNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [obs-productconverter]Fixed

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

  • [obs-server]Fixed

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

  • [obs-utils]Fixed

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

  • [obs-worker]Fixed

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]