Read the docs
TI-2024-14654 Aliases CVE-2024-22034GHSA-gm3v-m2w5-wm38

Crafted projects can overwrite special files in the .osc config directory

Priority LOW 24Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00209 11th percentileScored 2026-11-07
Fix Fixed SUSE Linux Enterprise Desktop 15 SP5 (SUSE): 1.9.0-150400.10.6.1SUSE Linux Enterprise High Performance Computing 15 SP5 (SUSE): 1.9.0-150400.10.6.1+14 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSESUSE Linux Enterprise Desktop 15 SP5? to before 1.9.0-150400.10.6.11.9.0-150400.10.6.1Patch availableCNA
SUSESUSE Linux Enterprise High Performance Computing 15 SP5? to before 1.9.0-150400.10.6.11.9.0-150400.10.6.1Patch availableCNA
SUSESUSE Linux Enterprise Module for Development Tools 15 SP5? to before 1.9.0-150400.10.6.11.9.0-150400.10.6.1Patch availableCNA
SUSESUSE Linux Enterprise Server 15 SP5? to before 1.9.0-150400.10.6.11.9.0-150400.10.6.1Patch availableCNA
SUSESUSE Linux Enterprise Server for SAP Applications 15 SP5? to before 1.9.0-150400.10.6.11.9.0-150400.10.6.1Patch availableCNA
SUSESUSE Linux Enterprise Desktop 15 SP6? to before 1.9.0-150400.10.6.11.9.0-150400.10.6.1Patch availableCNA
SUSESUSE Linux Enterprise High Performance Computing 15 SP6? to before 1.9.0-150400.10.6.11.9.0-150400.10.6.1Patch availableCNA
SUSESUSE Linux Enterprise Module for Development Tools 15 SP6? to before 1.9.0-150400.10.6.11.9.0-150400.10.6.1Patch availableCNA
SUSESUSE Linux Enterprise Server 15 SP6? to before 1.9.0-150400.10.6.11.9.0-150400.10.6.1Patch availableCNA
SUSESUSE Linux Enterprise Server for SAP Applications 15 SP6? to before 1.9.0-150400.10.6.11.9.0-150400.10.6.1Patch availableCNA
SUSESUSE Linux Enterprise Server 12 SP5? to before 0.183.0-15.18.10.183.0-15.18.1Patch availableCNA
SUSESUSE Linux Enterprise Server for SAP Applications 12 SP5? to before 0.183.0-15.18.10.183.0-15.18.1Patch availableCNA
SUSESUSE Linux Enterprise Software Development Kit 12 SP5? to before 0.183.0-15.18.10.183.0-15.18.1Patch availableCNA
SUSEopenSUSE Leap 15.5? to before 1.9.0-150400.10.6.11.9.0-150400.10.6.1Patch availableCNA
SUSEopenSUSE Leap 15.6? to before 1.9.0-150400.10.6.11.9.0-150400.10.6.1Patch availableCNA
SUSEopenSUSE Tumbleweed? to before 1.9.0-1.11.9.0-1.1Patch availableCNA
  • SUSE Linux Enterprise Desktop 15 SP5 VendorSUSE Affected ? to before 1.9.0-150400.10.6.1 Fixed in 1.9.0-150400.10.6.1 Patch available CNA
  • SUSE Linux Enterprise High Performance Computing 15 SP5 VendorSUSE Affected ? to before 1.9.0-150400.10.6.1 Fixed in 1.9.0-150400.10.6.1 Patch available CNA
  • SUSE Linux Enterprise Module for Development Tools 15 SP5 VendorSUSE Affected ? to before 1.9.0-150400.10.6.1 Fixed in 1.9.0-150400.10.6.1 Patch available CNA
  • SUSE Linux Enterprise Server 15 SP5 VendorSUSE Affected ? to before 1.9.0-150400.10.6.1 Fixed in 1.9.0-150400.10.6.1 Patch available CNA
  • SUSE Linux Enterprise Server for SAP Applications 15 SP5 VendorSUSE Affected ? to before 1.9.0-150400.10.6.1 Fixed in 1.9.0-150400.10.6.1 Patch available CNA
  • SUSE Linux Enterprise Desktop 15 SP6 VendorSUSE Affected ? to before 1.9.0-150400.10.6.1 Fixed in 1.9.0-150400.10.6.1 Patch available CNA
  • SUSE Linux Enterprise High Performance Computing 15 SP6 VendorSUSE Affected ? to before 1.9.0-150400.10.6.1 Fixed in 1.9.0-150400.10.6.1 Patch available CNA
  • SUSE Linux Enterprise Module for Development Tools 15 SP6 VendorSUSE Affected ? to before 1.9.0-150400.10.6.1 Fixed in 1.9.0-150400.10.6.1 Patch available CNA
  • SUSE Linux Enterprise Server 15 SP6 VendorSUSE Affected ? to before 1.9.0-150400.10.6.1 Fixed in 1.9.0-150400.10.6.1 Patch available CNA
  • SUSE Linux Enterprise Server for SAP Applications 15 SP6 VendorSUSE Affected ? to before 1.9.0-150400.10.6.1 Fixed in 1.9.0-150400.10.6.1 Patch available CNA
  • SUSE Linux Enterprise Server 12 SP5 VendorSUSE Affected ? to before 0.183.0-15.18.1 Fixed in 0.183.0-15.18.1 Patch available CNA
  • SUSE Linux Enterprise Server for SAP Applications 12 SP5 VendorSUSE Affected ? to before 0.183.0-15.18.1 Fixed in 0.183.0-15.18.1 Patch available CNA
  • SUSE Linux Enterprise Software Development Kit 12 SP5 VendorSUSE Affected ? to before 0.183.0-15.18.1 Fixed in 0.183.0-15.18.1 Patch available CNA
  • openSUSE Leap 15.5 VendorSUSE Affected ? to before 1.9.0-150400.10.6.1 Fixed in 1.9.0-150400.10.6.1 Patch available CNA
  • openSUSE Leap 15.6 VendorSUSE Affected ? to before 1.9.0-150400.10.6.1 Fixed in 1.9.0-150400.10.6.1 Patch available CNA
  • openSUSE Tumbleweed VendorSUSE Affected ? to before 1.9.0-1.1 Fixed in 1.9.0-1.1 Patch available CNA

Remediation

  • Fix · CNA SUSE Linux Enterprise Desktop 15 SP5 (SUSE) Fixed in 1.9.0-150400.10.6.1
  • Fix · CNA SUSE Linux Enterprise High Performance Computing 15 SP5 (SUSE) Fixed in 1.9.0-150400.10.6.1
  • Fix · CNA SUSE Linux Enterprise Module for Development Tools 15 SP5 (SUSE) Fixed in 1.9.0-150400.10.6.1
  • Fix · CNA SUSE Linux Enterprise Server 15 SP5 (SUSE) Fixed in 1.9.0-150400.10.6.1
  • Fix · CNA SUSE Linux Enterprise Server for SAP Applications 15 SP5 (SUSE) Fixed in 1.9.0-150400.10.6.1
  • Fix · CNA SUSE Linux Enterprise Desktop 15 SP6 (SUSE) Fixed in 1.9.0-150400.10.6.1
  • Fix · CNA SUSE Linux Enterprise High Performance Computing 15 SP6 (SUSE) Fixed in 1.9.0-150400.10.6.1
  • Fix · CNA SUSE Linux Enterprise Module for Development Tools 15 SP6 (SUSE) Fixed in 1.9.0-150400.10.6.1
  • Fix · CNA SUSE Linux Enterprise Server 15 SP6 (SUSE) Fixed in 1.9.0-150400.10.6.1
  • Fix · CNA SUSE Linux Enterprise Server for SAP Applications 15 SP6 (SUSE) Fixed in 1.9.0-150400.10.6.1
  • Fix · CNA SUSE Linux Enterprise Server 12 SP5 (SUSE) Fixed in 0.183.0-15.18.1
  • Fix · CNA SUSE Linux Enterprise Server for SAP Applications 12 SP5 (SUSE) Fixed in 0.183.0-15.18.1
  • Fix · CNA SUSE Linux Enterprise Software Development Kit 12 SP5 (SUSE) Fixed in 0.183.0-15.18.1
  • Fix · CNA openSUSE Leap 15.5 (SUSE) Fixed in 1.9.0-150400.10.6.1
  • Fix · CNA openSUSE Leap 15.6 (SUSE) Fixed in 1.9.0-150400.10.6.1
  • Fix · CNA openSUSE Tumbleweed (SUSE) Fixed in 1.9.0-1.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22034
  2. 2026-10-03 Alias added: GHSA-gm3v-m2w5-wm38

References

Other 1

  • TI-2016-03560 Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-03506 Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04302 Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04301 Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04298 Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
See all 1331 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences