CVE-2024-22034

Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim

Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim

These are all security issues fixed in the osc-1.9.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for osc fixes the following issues:

• 1.9.0

  • Security:
    • Fix possibility to overwrite special files in .osc (CVE-2024-22034 bsc#1225911) Source files are now stored in the 'sources' subdirectory which prevents name collisons. This requires changing version of '.osc' store to 2.0.
  • Command-line:
    • Introduce build --checks parameter
  • Library:
    • OscConfigParser: Remove automatic name option

• 1.8.3

  • Command-line:
    • Change 'repairwc' command to always run all repair steps
  • Library:
    • Make most of the fields in KeyinfoPubkey and KeyinfoSslcert models optional
    • Fix colorize() to avoid wrapping empty string into color escape sequences
    • Provide default values for kwargs.get/pop in get_results() function

• 1.8.2

  • Library:
    • Change 'repairwc' command to fix missing .osc/_osclib_version
    • Make error message in check_store_version() more generic to work for both projects and packages
    • Fix check_store_version in project store

• 1.8.1

  • Command-line:
    • Fix 'linkpac' command crash when used with '--disable-build' or '--disable-publish' option

• 1.8.0

  • Command-line:
    • Improve 'submitrequest' command to inherit description from superseded request
    • Fix 'mv' command when renaming a file multiple times
    • Improve 'info' command to support projects
    • Improve 'getbinaries' command by accepting '-M' / '--multibuild-package' option outside checkouts
    • Add architecture filtering to 'release' command
    • Change 'results' command so the normal and multibuild packages have the same output
    • Change 'results' command to use csv writer instead of formatting csv as string
    • Add couple mutually exclusive options errors to 'results' command
    • Set a default value for 'results --format' only for the csv output
    • Add support for 'results --format' for the default text mode
    • Update help text for '--format' option in 'results' command
    • Add 'results --fail-on-error/-F' flag
    • Redirect venv warnings from stderr to debug output
  • Configuration:
    • Fix config parser to throw an exception on duplicate sections or options
    • Modify conf.get_config() to print permissions warning to stderr rather than stdout
  • Library:
    • Run check_store_version() in obs_scm.Store and fix related code in Project and Package
    • Forbid extracting files with absolute path from 'cpio' archives (bsc#1122683)
    • Forbid extracting files with absolute path from 'ar' archives (bsc#1122683)
    • Remove no longer valid warning from core.unpack_srcrpm()
    • Make obs_api.KeyinfoSslcert keyid and fingerprint fields optional
    • Fix return value in build build.create_build_descr_data()
    • Fix core.get_package_results() to obey 'multibuild_packages' argument
  • Tests:
    • Fix tests so they don't modify fixtures

• 1.7.0

  • Command-line:
    • Add 'person search' command
    • Add 'person register' command
    • Add '-M/--multibuild-package' option to '[what]dependson' commands
    • Update '-U/--user' option in 'maintainer' command to accept also an email address
    • Fix 'branch' command to allow using '--new-package' option on packages that do not exist
    • Fix 'buildinfo' command to include obs:cli_debug_packages by default
    • Fix 'buildinfo' command to send complete local build environment as the 'build' command does
    • Fix 'maintainer --devel-project' to raise an error if running outside a working copy without any arguments
    • Fix handling arguments in 'service remoterun prj/pac'
    • Fix 'rebuild' command so the '--all' option conflicts with the 'package' argument
    • Fix crash when removing 'scmsync' element from dst package meta in 'linkpac' command
    • Fix crash when reading dst package meta in 'linkpac' command
    • Allow osc rpmlint to infer prj/pkg from CWD
    • Propagate exit code from the run() and do_() commandline methods
    • Give a hint where a scmsync git is hosted
    • Fix crash…

This update for osc fixes the following issues:

0.183.0

• Fix possibility to overwrite special files in .osc (CVE-2024-22034 bsc#1225911) Source files are now stored in the 'sources' subdirectory which prevents name collisons. This requires changing version of '.osc' store to 2.0.
• Fix errorneous double quotes in core.py