CVE catalog

CVE-2020-8021

open-build-service: CVE-2020-8021

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.30% · Oct 25, 2026

a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is disabled This issue affects: Open Build Service versions prior to 2.10.5.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopen-build-servicesid2.9.4-13fixed
Debianopen-build-servicebookworm2.9.4-9fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopen-build-servicesourcesid2.9.4-4not yet assignedNot reported[983576]
Debianopen-build-servicesourcebookworm2.9.4-4not yet assignedNot reported[983576]

[Debian bug #983576]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [obs-productconverter]Fixed

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-4

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-4

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

  • [obs-server]Fixed

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-4

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-4

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

  • [obs-utils]Fixed

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-4

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-4

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

  • [obs-worker]Fixed

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-4

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

    • 2.9.4-9 · all · bookworm

      Fixed · Fixed: 2.9.4-4

      dsa · open-build-service · debian · bookworm; dsa · open-build-service · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]