Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 428
Alerts This Week
Warning Icon 1 428

SUSE: 2019:2067-1 Important: osc TLS Man-in-the-Middle Issue

suse
Calendar Grey August 6, 2019
Dist Suse Esm H88
SUSE has released a Security Update for osc that addresses a vulnerability in TLS, which could enable man-in-the-middle attacks, along with significant patches included.
An update that solves one vulnerability and has 5 fixes is now available

Summary

This update for osc to version 0.165.4 fixes the following issues: Security issue fixed: - CVE-2019-3685: Fixed broken TLS certificate handling allowing for a Man-in-the-middle attack (bsc#1142518). Non-security issues fixed: - support different token operations (runservice, release and rebuild) (requires OBS 2.10) - fix osc token decode error - offline build mode is now really offline and does not try to download the buildconfig - osc build -define now works with python3 - fixes an issue where the error message on osc meta -e was not parsed correctly - osc maintainer -s now works with python3 - simplified and fixed osc meta -e (bsc#1138977) - osc lbl now works with non utf8 encoding (bsc#1129889) - add simpleimage as local build type - allow optional fork when creating a maintenance request - fix RPMError fallback

References

#1129889 #1138977 #1140697 #1142518 #1142662

#1144211

Cross- CVE-2019-3685

Affected Products:

SUSE Linux Enterprise Module for Development Tools 15-SP1

https://www.suse.com/security/cve/CVE-2019-3685.html

https://bugzilla.suse.com/1129889

https://bugzilla.suse.com/1138977

https://bugzilla.suse.com/1140697

https://bugzilla.suse.com/1142518

https://bugzilla.suse.com/1142662

https://bugzilla.suse.com/1144211

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2019:2067-1
Rating: important

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.