CVE catalog

CVE-2019-3685

osc: CVE-2019-3685

[CVE catalog]

Severity
High · CVSS 7.4CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.71% · Oct 25, 2026

Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianoscsid1.15.1-1not affected
Debianoscforky1.15.1-1not affected
Debianosctrixie1.12.1-2not affected
Debianoscbookworm0.169.1-2not affected
Suseosclinux enterprise module for development tools 15 sp10.165.4-3.9.1fixed
Opensuseoscleap 15.10.165.4-lp151.2.6.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
DebianoscsourcesidNot affectedunimportantNot reportedNot reported
DebianoscsourceforkyNot affectedunimportantNot reportedNot reported
DebianoscsourcetrixieNot affectedunimportantNot reportedNot reported
DebianoscsourcebookwormNot affectedunimportantNot reportedNot reported
Suseoscrpmlinux enterprise module for development tools 15 sp10.165.4-3.9.1Not reportedSUSE-SU-2019:2067-1Not reported
Opensuseoscrpmleap 15.10.165.4-lp151.2.6.1Not reportedOPENSUSE-SU-2019:1844-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [osc]Not affected
    Details (2)

    • 0.169.1-2 · all · bookworm

      Not affected

      dsa · osc · debian · bookworm

    • 0.169.1-2 · all · bookworm

      Not affected

      dsa · osc · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]