CVE catalog

CVE-2017-9274

osc: CVE-2017-9274

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.30% · Oct 25, 2026

A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianoscsid1.15.1-1fixed
Debianoscforky1.15.1-1fixed
Debianosctrixie1.12.1-2fixed
Debianoscbookworm0.169.1-2fixed
Opensuseobs-service-source_validatortumbleweed0.21-1.3fixed
Ubuntuosc16.040.152.0-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianoscsourcesid0.162.1-1not yet assignedNot reported[887391]
Debianoscsourceforky0.162.1-1not yet assignedNot reported[887391]
Debianoscsourcetrixie0.162.1-1not yet assignedNot reported[887391]
Debianoscsourcebookworm0.162.1-1not yet assignedNot reported[887391]
Opensuseobs-service-source_validatorrpmtumbleweed0.21-1.3Not reportedOPENSUSE-SU-2024:11106-1Not reported

[Debian bug #887391]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [osc]Fixed
    Details (2)

    • 0.169.1-2 · all · bookworm

      Fixed · Fixed: 0.162.1-1

      dsa · osc · debian · bookworm; dsa · osc · debian · 12

    • 0.169.1-2 · all · bookworm

      Fixed · Fixed: 0.162.1-1

      dsa · osc · debian · bookworm; dsa · osc · debian · 12

[Debian 13 (Trixie)]

  • [osc]Fixed
    Details (2)

    • 1.12.1-2 · all · trixie

      Fixed · Fixed: 0.162.1-1

      dsa · osc · debian · 13

    • 1.12.1-2 · all · trixie

      Fixed · Fixed: 0.162.1-1

      dsa · osc · debian · 13

[openSUSE Tumbleweed]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]