CVE-2019-3681

osc: stores downloaded (supposed) RPM in network-controlled filesystem paths

7.5 HighFix available

CVE-2019-3681 is a high vulnerability (CVSS 7.5) in Opensuse Factory, published June 3, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in osc 0.169.1-1.

A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc versions prior to 0.169.0 .

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.39%Up 0.9 points since Apr 14, 2021

What each source reports

CVE List Score used 7.5

osc: stores downloaded (supposed) RPM in network-controlled filesystem paths

Record: CVE-2019-3681
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-73
Updated: 2026-11-02

EUVDEUVD-2019-13316 7.5

Record: EUVD-2019-13316
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9w8p-3cm4-h4c7 No score

A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for...

Record: GHSA-9w8p-3cm4-h4c7
Updated: 2026-11-02

NVD 7.5

Record: CVE-2019-3681
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 6.4 MediumAV:N/AC:L/Au:N/C:N/I:P/A:P
Weakness: CWE-73
Updated: 2026-11-02

OSV 9.8

Record: CVE-2019-3681
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-3681 9.8

Record: DEBIAN-CVE-2019-3681
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 7 moreShow less

OSVUBUNTU-CVE-2019-3681 7.5

Record: UBUNTU-CVE-2019-3681
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0852-1 No score

Security update for osc

This update for osc to 0.169.1 fixes the following issues:

Security issue fixed:

CVE-2019-3681: Fixed an insufficient validation of network-controlled filesystem paths (bsc#1122675).

Non-security issues fixed:

Improved the speed and usability of osc bash completion.
improved some error messages.
osc add: support git@ (private github) or git:// URLs correctly.
Split dependson and whatdependson commands.
Added support for osc build --shell-cmd.
Added pkg-ccache support for osc build.
Added --ccache option to osc getbinaries

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Record: openSUSE-SU-2020:0852-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11133-1 No score

osc-0.174.0-1.2 on GA media

These are all security issues fixed in the osc-0.174.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11133-1
Updated: 2026-11-02

OSVSUSE-SU-2020:1528-1 No score

Security update for osc

This update for osc fixes the following issues:

Security issue fixed:

CVE-2019-3681: Fixed an insufficient validation of network-controlled filesystem paths (bsc#1122675).

Record: SUSE-SU-2020:1528-1
Updated: 2026-11-02

OSVSUSE-SU-2020:1695-1 No score

Security update for osc

This update for osc to 0.169.1 fixes the following issues:

Security issue fixed:

CVE-2019-3681: Fixed an insufficient validation of network-controlled filesystem paths (bsc#1122675).

Non-security issues fixed:

Improved the speed and usability of osc bash completion.
improved some error messages.
osc add: support git@ (private github) or git:// URLs correctly.
Split dependson and whatdependson commands.
Added support for osc build --shell-cmd.
Added pkg-ccache support for osc build.
Added --ccache option to osc getbinaries

Record: SUSE-SU-2020:1695-1
Updated: 2026-11-02

OSVSUSE-SU-2020:1695-2 No score

Security update for osc

This update for osc to 0.169.1 fixes the following issues:

Security issue fixed:

CVE-2019-3681: Fixed an insufficient validation of network-controlled filesystem paths (bsc#1122675).

Non-security issues fixed:

Improved the speed and usability of osc bash completion.
improved some error messages.
osc add: support git@ (private github) or git:// URLs correctly.
Split dependson and whatdependson commands.
Added support for osc build --shell-cmd.
Added pkg-ccache support for osc build.
Added --ccache option to osc getbinaries

Record: SUSE-SU-2020:1695-2
Updated: 2026-11-02

OSVSUSE-SU-2022:4351-1 No score

Security update for osc

This update for osc fixes the following issues:

osc was updated to version 0.182.0 (bsc#1154972, bsc#1144211, bsc#1142662, bsc#1140697, bsc#1138165):

Added MFA support (jsc#OBS-203).
CVE-2019-3681: Fixed vulnerability where osc stored downloaded RPMs in network controlled paths (bsc#1122675).
CVE-2019-3685: Fixed broken TLS certificate handling (bsc#1142518).

Bugfixes:

Removed use of chardet to guess encoding. Utf-8 or latin-1 is now assumed, which will speed up decoding (bsc#1173926).
Added helper method _html_escape to enable python3.8 and python2.* compatibility (bsc#1166537).
Added MR creation to honor orev (bsc#1160446).
Fixed local build outside of the working copy of a package (bsc#1136584).
Don't enforce password reuse (bsc#1156501).
osc vc --file=foo bar.changes now writes the content from foo into bar.changes instead of creating a new file (bsc#1155953).
Fixed decoding on osc lbl (bsc#1137477).
Simplified and fixed osc meta -e (bsc#1138977).
osc lbl now works with non utf8 encoding (bsc#1129889).
Added full python3 compatibility (bsc#1125243, bsc#1131512, bsc#1129757).
Fixed slowdown of rbl with readline(bufsize) function (bsc#1127932).
Fixed osc build -p dir TypeError (bsc#1126055).
Fixed osc buildinfo -p TypeError (bsc#1126058).
Added new options --unexpand and --meta to diff command (bsc#1089025).
Fixed Requires to python-base which does not contain ssl.py (bsc#1097996).

Record: SUSE-SU-2022:4351-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`osc` Debian:12	before 0.169.1-1	0.169.1-1
`osc` Debian:13	before 0.169.1-1	0.169.1-1
`osc` Debian:14	before 0.169.1-1	0.169.1-1
`osc` SUSE:Linux Enterprise Software Development Kit 12 SP4	before 0.162.1-15.9.1	0.162.1-15.9.1
`osc` SUSE:Linux Enterprise Software Development Kit 12 SP5	before 0.162.1-15.9.1	0.162.1-15.9.1
`osc` SUSE:Linux Enterprise Module for Development Tools 15 SP1	before 0.169.1-3.20.1	0.169.1-3.20.1
`osc` SUSE:Linux Enterprise Module for Development Tools 15 SP2	before 0.169.1-3.20.1	0.169.1-3.20.1
`osc` SUSE:Linux Enterprise Software Development Kit 12 SP5	before 0.182.0-15.12.1	0.182.0-15.12.1
`osc` Ubuntu:16.04:LTS	All versions, plus listed versions 0.152.0-1	None known
`osc` Ubuntu:18.04:LTS	All versions, plus listed versions 0.159.0-10.160.0-10.161.1-10.162.1-1	None known

Show 8 moreShow less

Affected packages
Package	Affected	Fixed
`osc` Ubuntu:20.04:LTS	All versions, plus listed versions 0.164.2-10.164.2-1build10.165.4-10.167.1-1	None known
`osc` Ubuntu:22.04:LTS	All versions, plus listed versions 0.169.1-1	None known
`osc` Ubuntu:24.04:LTS	All versions, plus listed versions 0.169.1-20.169.1-2ubuntu1	None known
`osc` Ubuntu:25.10	All versions, plus listed versions 1.12.1-21.15.1-1	None known
`osc` Ubuntu:26.10	All versions, plus listed versions 1.15.1-1	None known
`osc` Ubuntu:26.04:LTS	All versions, plus listed versions 1.15.1-1	None known
`osc` openSUSE:Leap 15.1	before 0.169.1-lp151.2.15.1	0.169.1-lp151.2.15.1
`osc` openSUSE:Tumbleweed	before 0.174.0-1.2	0.174.0-1.2

History

History
When	Changed	Sources
2026-11-03	aliases, products	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 31 moreShow less