Read the docs
TI-2018-08960 Aliases CVE-2018-12474GHSA-2g8g-ghh7-j7r3

Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm

Priority MEDIUM 45CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Improper input validation in obs-service-tar_scm of Open Build Service allows remote attackers to cause access and extract information outside the current build or cause the creation of file in attacker controlled locations. Affected releases are openSUSE Open Build Service: versions prior to 51a17c553b6ae2598820b7a90fd0c11502a49106.

Why it matters now

EPSS 0.01363 71st percentileScored 2026-11-07
Fix Fixed Open Build Service (openSUSE): 51a17c553b6ae2598820b7a90fd0c11502a49106

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
openSUSEOpen Build Servicebefore 51a17c553b6ae2598820b7a90fd0c11502a4910651a17c553b6ae2598820b7a90fd0c11502a49106Patch availableCNA
  • Open Build Service VendoropenSUSE Affected before 51a17c553b6ae2598820b7a90fd0c11502a49106 Fixed in 51a17c553b6ae2598820b7a90fd0c11502a49106 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:opensuse:tar_scm:*:*:*:*:*:*:*:*before 0.9.3VulnerableopenSUSE
  • cpe:2.3:o:opensuse:tar_scm:*:*:*:*:*:*:*:* Versions before 0.9.3 Vulnerable ·openSUSE

Remediation

  • Fix · CNA Open Build Service (openSUSE) Fixed in 51a17c553b6ae2598820b7a90fd0c11502a49106

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-12474
  2. 2026-10-03 Alias added: GHSA-2g8g-ghh7-j7r3

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences