CVE-2019-3685

Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary

Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary

Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary

Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary

Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary

This update for osc to version 0.165.4 fixes the following issues:

Security issue fixed:

• CVE-2019-3685: Fixed broken TLS certificate handling allowing for a Man-in-the-middle attack (bsc#1142518).

Non-security issues fixed:

• support different token operations (runservice, release and rebuild) (requires OBS 2.10)
• fix osc token decode error
• offline build mode is now really offline and does not try to download the buildconfig
• osc build -define now works with python3
• fixes an issue where the error message on osc meta -e was not parsed correctly
• osc maintainer -s now works with python3
• simplified and fixed osc meta -e (bsc#1138977)
• osc lbl now works with non utf8 encoding (bsc#1129889)
• add simpleimage as local build type
• allow optional fork when creating a maintenance request
• fix RPMError fallback
• fix local caching for all package formats
• fix appname for trusted cert store
• osc -h does not break anymore when using plugins
• switch to difflib.diff_bytes and sys.stdout.buffer.write for diffing. This will fix all decoding issues with osc diff, osc ci and osc rq -d
• fix osc ls -lb handling empty size and mtime
• removed decoding on osc api command.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the osc-0.174.0-1.2 package on the GA media of openSUSE Tumbleweed.

This update for osc to version 0.165.4 fixes the following issues:

Security issue fixed:

• CVE-2019-3685: Fixed broken TLS certificate handling allowing for a Man-in-the-middle attack (bsc#1142518).

Non-security issues fixed:

• support different token operations (runservice, release and rebuild) (requires OBS 2.10)
• fix osc token decode error
• offline build mode is now really offline and does not try to download the buildconfig
• osc build -define now works with python3
• fixes an issue where the error message on osc meta -e was not parsed correctly
• osc maintainer -s now works with python3
• simplified and fixed osc meta -e (bsc#1138977)
• osc lbl now works with non utf8 encoding (bsc#1129889)
• add simpleimage as local build type
• allow optional fork when creating a maintenance request
• fix RPMError fallback
• fix local caching for all package formats
• fix appname for trusted cert store
• osc -h does not break anymore when using plugins
• switch to difflib.diff_bytes and sys.stdout.buffer.write for diffing. This will fix all decoding issues with osc diff, osc ci and osc rq -d
• fix osc ls -lb handling empty size and mtime
• removed decoding on osc api command.

This update for osc fixes the following issues:

osc was updated to version 0.182.0 (bsc#1154972, bsc#1144211, bsc#1142662, bsc#1140697, bsc#1138165):

• Added MFA support (jsc#OBS-203).
• CVE-2019-3681: Fixed vulnerability where osc stored downloaded RPMs in network controlled paths (bsc#1122675).
• CVE-2019-3685: Fixed broken TLS certificate handling (bsc#1142518).

Bugfixes:

• Removed use of chardet to guess encoding. Utf-8 or latin-1 is now assumed, which will speed up decoding (bsc#1173926).
• Added helper method _html_escape to enable python3.8 and python2.* compatibility (bsc#1166537).
• Added MR creation to honor orev (bsc#1160446).
• Fixed local build outside of the working copy of a package (bsc#1136584).
• Don't enforce password reuse (bsc#1156501).
• osc vc --file=foo bar.changes now writes the content from foo into bar.changes instead of creating a new file (bsc#1155953).
• Fixed decoding on osc lbl (bsc#1137477).
• Simplified and fixed osc meta -e (bsc#1138977).
• osc lbl now works with non utf8 encoding (bsc#1129889).
• Added full python3 compatibility (bsc#1125243, bsc#1131512, bsc#1129757).
• Fixed slowdown of rbl with readline(bufsize) function (bsc#1127932).
• Fixed osc build -p dir TypeError (bsc#1126055).
• Fixed osc buildinfo -p TypeError (bsc#1126058).
• Added new options --unexpand and --meta to diff command (bsc#1089025).
• Fixed Requires to python-base which does not contain ssl.py (bsc#1097996).