CVE catalog

CVE-2018-12467

open-build-service: CVE-2018-12467

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.65% · Oct 25, 2026

Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopen-build-servicesid2.9.4-13fixed
Debianopen-build-servicebookworm2.9.4-9fixed
Ubuntuopen-build-service18.042.7.4-2vulnerable
Ubuntuopen-build-service24.042.9.4-9vulnerable
Ubuntuopen-build-service24.042.9.4-10vulnerable
Ubuntuopen-build-service25.102.9.4-10vulnerable
Ubuntuopen-build-service26.042.9.4-10vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopen-build-servicesourcesid2.9.4-1not yet assignedNot reported[911797]
Debianopen-build-servicesourcebookworm2.9.4-1not yet assignedNot reported[911797]

[Debian bug #911797]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [obs-productconverter]Fixed

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

  • [obs-server]Fixed

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

  • [obs-utils]Fixed

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

  • [obs-worker]Fixed

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]