CVE-2018-12477
obs-service-refresh_patches can be tricked into deleting '..' or other unrelated directories
A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-service-refresh_patches to delete them. Affected releases are openSUSE Open Build Service: versions prior to d6244245dda5367767efc989446fe4b5e4609cce.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
obs-service-refresh_patches can be tricked into deleting '..' or other unrelated directories
A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-service-refresh_patches to delete them. Affected releases are openSUSE Open Build Service: versions prior to d6244245dda5367767efc989446fe4b5e4609cce.
- Record
CVE-2018-12477- CVSS 3.0
- 3.5 Low
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-93
- Updated
- 2026-11-02
EUVDEUVD-2018-4447
A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-service-refresh_patches to delete them. Affected releases are openSUSE Open Build Service: versions prior to d6244245dda5367767efc989446fe4b5e4609cce.
- Record
EUVD-2018-4447- CVSS 3.0
- 3.5 Low
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vp32-rg8f-2jxg
A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote...
A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-service-refresh_patches to delete them. Affected releases are openSUSE Open Build Service: versions prior to d6244245dda5367767efc989446fe4b5e4609cce.
- Record
GHSA-vp32-rg8f-2jxg- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-93
- Updated
- 2026-11-02
NVD
A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-service-refresh_patches to delete them. Affected releases are openSUSE Open Build Service: versions prior to d6244245dda5367767efc989446fe4b5e4609cce.
- Record
CVE-2018-12477- CVSS 3.0
- 3.5 Low
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-93
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11105-1 No score
obs-service-refresh_patches-0.3.9+git.1625238904.d59f20e-1.2 on GA media
These are all security issues fixed in the obs-service-refresh_patches-0.3.9+git.1625238904.d59f20e-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11105-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
obs-service-refresh_patchesopenSUSE:Tumbleweed |
before 0.3.9+git.1625238904.d59f20e-1.2 | 0.3.9+git.1625238904.d59f20e-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-12477 is a low vulnerability (CVSS 3.5) in Opensuse Open Build Service, published October 9, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.17%, the 67th percentile. Fixed in obs-service-refresh_patches 0.3.9+git.1625238904.d59f20e-1.2.