CVE-2017-9274
osc executes spec code during "osc commit"
A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
osc executes spec code during "osc commit"
A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.
- Record
CVE-2017-9274- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2017-18210
A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.
- Record
EUVD-2017-18210- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rmgp-j5rm-7ghv
A shell command injection in the obs-service-source_validator before 0.7 could be used to execute...
A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.
- Record
GHSA-rmgp-j5rm-7ghv- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.
- Record
CVE-2017-9274- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.
- Record
CVE-2017-9274- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-9274
A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.
- Record
DEBIAN-CVE-2017-9274- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2017-9274
A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.
- Record
UBUNTU-CVE-2017-9274- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11106-1 No score
obs-service-source_validator-0.21-1.3 on GA media
These are all security issues fixed in the obs-service-source_validator-0.21-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11106-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:3253-1 No score
Fixing security issues on OBS toolchain
This OBS toolchain update fixes the following issues:
Package 'build':
- CVE-2010-4226: force use of bsdtar for VMs (bnc#665768)
- CVE-2017-14804: Improve file name check extractbuild (bsc#1069904)
- switch baselibs scheme for debuginfo packages from foo-debuginfo-32bit to foo-32bit-debuginfo (fate#323217)
Package 'obs-service-source_validator':
- CVE-2017-9274: Don't use rpmbuild to extract sources, patches etc. from a spec (bnc#938556).
- Update to version 0.7
- use spec_query instead of output_versions using the specfile parser from the build package (boo#1059858)
Package 'osc':
- update to version 0.162.0
- add Recommends: ca-certificates to enable TLS verification without manually installing them. (bnc#1061500)
- Record
SUSE-SU-2017:3253-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0065-1 No score
Fixing security issues on OBS toolchain
This OBS toolchain update fixes the following issues:
Package 'build':
- CVE-2017-14804: Improve file name check extractbuild (bsc#1069904)
- Fixed Dockerfile repository parsing
Package 'obs-service-source_validator':
- CVE-2017-9274: Don't use rpmbuild to extract sources, patches etc. from a spec (bnc#938556).
- CVE-2016-4007: Several maintained source services are vulnerable to code/paramter injection (bsc#967265)
- Update to version 0.7.
- Use spec_query instead of output_versions using the specfile parser from the build package (boo#1059858)
- obs-service-source_validator: several occurrences of uninitialized value (bsc#967610)
- hack for util-linux specfiles (bnc#891829)
- fix dependency to gnupg2 for Fedora (bnc#827480)
- exit if tmpdir creation fails (bnc#796918)
Package 'osc':
- Update to version 0.162.0.
- Record
SUSE-SU-2018:0065-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
oscDebian:12 |
before 0.162.1-1 | 0.162.1-1 |
oscDebian:13 |
before 0.162.1-1 | 0.162.1-1 |
oscDebian:14 |
before 0.162.1-1 | 0.162.1-1 |
buildSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 20171128-9.3.2 | 20171128-9.3.2 |
obs-service-source_validatorSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 0.7-9.3.1 | 0.7-9.3.1 |
oscSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 0.162.0-15.3.1 | 0.162.0-15.3.1 |
buildSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 20171128-9.3.2 | 20171128-9.3.2 |
obs-service-source_validatorSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 0.7-9.3.1 | 0.7-9.3.1 |
oscSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 0.162.0-15.3.1 | 0.162.0-15.3.1 |
buildSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 20171128-8.3.3 | 20171128-8.3.3 |
oscSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 0.162.1-7.4.1 | 0.162.1-7.4.1 |
oscUbuntu:16.04:LTS |
All versions, plus listed versions 0.152.0-1 |
None known |
obs-service-source_validatoropenSUSE:Tumbleweed |
before 0.21-1.3 | 0.21-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-9274 is a high vulnerability (CVSS 7.8) in Opensuse Obs-service-source Validator, published December 8, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.31%, the 83rd percentile. Fixed in osc 0.162.1-1.
References
lists.opensuse.org/opensuse-security-announce/2017-12/msg00024.html
suse.com/de-de/security/cve/CVE-2017-9274
bugzilla.suse.com/show_bug.cgi?id=938556
nvd.nist.gov/vuln/detail/CVE-2017-9274
github.com/advisories/GHSA-rmgp-j5rm-7ghv
security-tracker.debian.org/tracker/CVE-2017-9274
Show 19 moreShow less
ubuntu.com/security/CVE-2017-9274
cve.org/CVERecord?id=CVE-2017-9274