CVE-2018-12477

A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-service-refresh_patches to delete them. Affected releases are openSUSE Open Build Service: versions prior to d6244245dda5367767efc989446fe4b5e4609cce.

Score

CVSS 3.0 7.5 High

Status

Modified - security@opentext.com

Published

2018-10-09

Last modified

2024-09-16

Weaknesses

CWE-93

Affected products

• Leap (Opensuse)
• Open Build Service (Opensuse)

References

• https://bugzilla.suse.com/show_bug.cgi?id=1108189
• https://lwn.net/Articles/766535/