{"id":"CVE-2018-12476","aliases":["EUVD-2018-4446","GHSA-7vq9-fwhq-w55p","SUSE-SU-2019:0540-1","openSUSE-SU-2019:0326-1","openSUSE-SU-2019:0329-1","openSUSE-SU-2024:11107-1"],"status":"published","title":"obs-service-extract_file's outfilename parameter allows to write files outside of package directory","description":"Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a repository to overwrite files on the machine of the local user if a malicious service is executed. This issue affects: SUSE Linux Enterprise Server 15 obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74:. openSUSE Factory obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01026,"percentile":0.63839,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-23"],"published":"2019-03-04T16:42:47Z","modified":"2026-06-17T01:37:51Z","affected":[{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"obs-service-tar_scm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.5.1551309990.79898c7-lp150.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"obs-service-tar_scm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.5.1551309990.79898c7-bp150.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"obs-service-tar_scm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.28.1632141620.a8837d3-1.1"}]}],"bundled":3}],"products":[{"vendor":"opensuse","product":"factory"},{"vendor":"suse","product":"obs-service-tar_scm"},{"vendor":"suse","product":"suse linux enterprise server 15"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1107944","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12476"},{"url":"https://github.com/advisories/GHSA-7vq9-fwhq-w55p"},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190540-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1076410","tags":["report"]},{"url":"https://bugzilla.suse.com/1082696","tags":["report"]},{"url":"https://bugzilla.suse.com/1105361","tags":["report"]},{"url":"https://bugzilla.suse.com/1107507","tags":["report"]},{"url":"https://bugzilla.suse.com/1107944","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12476","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/24JIOIQBREAYJ3BG7I4ULI6HBEJZRTP6/#24JIOIQBREAYJ3BG7I4ULI6HBEJZRTP6","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SKGGMO3NGZX2ZLQDMAHVVJX4HZMC2X3E/#SKGGMO3NGZX2ZLQDMAHVVJX4HZMC2X3E","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-12476","title":"obs-service-extract_file's outfilename parameter allows to write files outside of package directory","description":"Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a repository to overwrite files on the machine of the local user if a malicious service is executed. This issue affects: SUSE Linux Enterprise Server 15 obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74:. openSUSE Factory obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74.","status":"published","published":"2020-01-27T08:30:14.943Z","modified":"2024-09-16T20:52:13.615Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:35:06.320867Z"}],"euvd":[{"id":"EUVD-2018-4446","description":"Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a repository to overwrite files on the machine of the local user if a malicious service is executed. This issue affects: SUSE Linux Enterprise Server 15 obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74:. openSUSE Factory obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74.","status":"published","published":"2020-01-27T08:30:14Z","modified":"2024-09-16T20:52:13Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:55:10.446271Z"}],"ghsa":[{"id":"GHSA-7vq9-fwhq-w55p","title":"Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15;...","description":"Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a repository to overwrite files on the machine of the local user if a malicious service is executed. This issue affects: SUSE Linux Enterprise Server 15 obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74:. openSUSE Factory obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74.","status":"published","published":"2022-05-24T17:07:24Z","modified":"2023-01-29T05:01:23Z","updated_at":"2026-11-02T14:44:48.378382Z"}],"nvd":[{"id":"CVE-2018-12476","description":"Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a repository to overwrite files on the machine of the local user if a malicious service is executed. This issue affects: SUSE Linux Enterprise Server 15 obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74:. openSUSE Factory obs-service-tar_scm versions prior to 0.9.2.1537788075.fefaa74.","status":"published","published":"2020-01-27T09:15:11.1Z","modified":"2026-06-17T01:37:51.38Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-23","CWE-22"],"updated_at":"2026-11-02T14:05:00.03074Z"}],"osv":[{"id":"openSUSE-SU-2019:0326-1","title":"Security update for obs-service-tar_scm","description":"This update for obs-service-tar_scm fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2018-12473: Fixed a path traversal issue, which allowed users to access\n  files outside of the repository using relative paths (bsc#1105361)\n- CVE-2018-12474: Fixed an issue whereby crafted service parameters allowed for\n  unexpected behaviour (bsc#1107507)\n- CVE-2018-12476: Fixed an issue whereby the outfilename parameter allowed to\n  write files outside of package directory (bsc#1107944)\n\nOther bug fixes and changes made:\n\n- Prefer UTF-8 locale as output format for changes\n- added KankuFile\n- fix problems with unicode source files\n- added python-six to Requires in specfile\n- better encoding handling\n- fixes bsc#1082696 and bsc#1076410\n- fix unicode in containers\n- move to python3\n- added logging for better debugging changesgenerate\n- raise exception if no changesauthor given\n- Stop using @opensuse.org addresses to indicate a missing address\n- move argparse dep to -common package\n- allow submodule and ssl options in appimage\n- sync spec file as used in openSUSE:Tools project\n- check encoding problems for svn and print proper error msg\n- added new param '--locale'\n- separate service file installation in GNUmakefile\n- added glibc as Recommends in spec file\n- cleanup for broken svn caches\n- another fix for unicode problem in obs_scm\n- Final fix for unicode in filenames\n- Another attempt to fix unicode filenames in prep_tree_for_archive\n- Another attempt to fix unicode filenames in prep_tree_for_archive\n- fix bug with unicode filenames in prep_tree_for_archive\n- reuse _service*_servicedata/changes files from previous service runs\n- fix problems with  unicode characters in commit messages for changeloggenerate\n- fix encoding issues if commit message contains utf8 char\n- revert encoding for old changes file\n- remove hardcoded utf-8 encodings\n- Add support for extract globbing\n- split pylint2 in GNUmakefile\n- fix check for '--reproducible'\n- create reproducible obscpio archives\n- fix regression from 44b3bee\n- Support also SSH urls for Git\n- check name/version option in obsinfo for slashes\n- check url for remote url\n- check symlinks in subdir parameter\n- check filename for slashes\n- disable follow_symlinks in extract feature\n- switch to obs_scm for this package\n- run download_files in appimage and snapcraft case\n- check --extract file path for parent dir\n- Fix parameter descriptions\n- changed os.removedirs -\u003e shutil.rmtree\n- Adding information regarding the *package-metadata* option for the *tar* service The tar service is highly useful in combination with the *obscpio* service. After the fix for the metadata for the latter one, it is important to inform the users of the *tar* service that metadata is kept only if the flag *package-metadata* is enabled. Add the flag to the .service file for mentioning that.\n- Allow metadata packing for CPIO archives when desired As of now, metadata are always excluded from *obscpio* packages. This is because the *package-metadata* flag is ignored; this change (should) make *obscpio* aware of it.\n- improve handling of corrupt git cache directories\n- only do git stash save/pop if we have a non-empty working tree (#228)\n- don't allow DEBUG_TAR_SCM to change behaviour (#240)\n- add stub user docs in lieu of something proper (#238)\n- Remove clone_dir if clone fails\n- python-unittest2 is only required for the optional make check\n- move python-unittest2 dep to test suite only part (submission by olh)\n- Removing redundant pass statement\n- missing import for logging functions.\n- [backend] Adding http proxy support\n- python-unittest2 is only required for the optional make check\n- make installation of scm's optional\n- add a lot more detail to README\n- Git clone with --no-checkout in prepare_working_copy\n- Refactor and simplify git prepare_working_copy\n- Only use current dir if it actually looks like git (Fixes #202)\n- reactivate test_obscpio_extract_d\n- fix broken test create_archive\n- fix broken tests for broken-links\n- changed PREFIX in Gnumakefile to /usr\n- new cli option --skip-cleanup\n- fix for broken links\n- fix reference to snapcraft YAML file\n- fix docstring typo in TarSCM.scm.tar.fetch_upstream\n- acknowledge deficiencies in dev docs\n- wrap long lines in README\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T11:14:32Z","modified":"2026-02-04T04:04:34.135969Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2019:0329-1","title":"Security update for obs-service-tar_scm","description":"This update for obs-service-tar_scm fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2018-12473: Fixed a path traversal issue, which allowed users to access\n  files outside of the repository using relative paths (bsc#1105361)\n- CVE-2018-12474: Fixed an issue whereby crafted service parameters allowed for\n  unexpected behaviour (bsc#1107507)\n- CVE-2018-12476: Fixed an issue whereby the outfilename parameter allowed to\n  write files outside of package directory (bsc#1107944)\n\nOther bug fixes and changes made:\n\n- Prefer UTF-8 locale as output format for changes\n- added KankuFile\n- fix problems with unicode source files\n- added python-six to Requires in specfile\n- better encoding handling\n- fixes bsc#1082696 and bsc#1076410\n- fix unicode in containers\n- move to python3\n- added logging for better debugging changesgenerate\n- raise exception if no changesauthor given\n- Stop using @opensuse.org addresses to indicate a missing address\n- move argparse dep to -common package\n- allow submodule and ssl options in appimage\n- sync spec file as used in openSUSE:Tools project\n- check encoding problems for svn and print proper error msg\n- added new param '--locale'\n- separate service file installation in GNUmakefile\n- added glibc as Recommends in spec file\n- cleanup for broken svn caches\n- another fix for unicode problem in obs_scm\n- Final fix for unicode in filenames\n- Another attempt to fix unicode filenames in prep_tree_for_archive\n- Another attempt to fix unicode filenames in prep_tree_for_archive\n- fix bug with unicode filenames in prep_tree_for_archive\n- reuse _service*_servicedata/changes files from previous service runs\n- fix problems with  unicode characters in commit messages for changeloggenerate\n- fix encoding issues if commit message contains utf8 char\n- revert encoding for old changes file\n- remove hardcoded utf-8 encodings\n- Add support for extract globbing\n- split pylint2 in GNUmakefile\n- fix check for '--reproducible'\n- create reproducible obscpio archives\n- fix regression from 44b3bee\n- Support also SSH urls for Git\n- check name/version option in obsinfo for slashes\n- check url for remote url\n- check symlinks in subdir parameter\n- check filename for slashes\n- disable follow_symlinks in extract feature\n- switch to obs_scm for this package\n- run download_files in appimage and snapcraft case\n- check --extract file path for parent dir\n- Fix parameter descriptions\n- changed os.removedirs -\u003e shutil.rmtree\n- Adding information regarding the *package-metadata* option for the *tar* service The tar service is highly useful in combination with the *obscpio* service. After the fix for the metadata for the latter one, it is important to inform the users of the *tar* service that metadata is kept only if the flag *package-metadata* is enabled. Add the flag to the .service file for mentioning that.\n- Allow metadata packing for CPIO archives when desired As of now, metadata are always excluded from *obscpio* packages. This is because the *package-metadata* flag is ignored; this change (should) make *obscpio* aware of it.\n- improve handling of corrupt git cache directories\n- only do git stash save/pop if we have a non-empty working tree (#228)\n- don't allow DEBUG_TAR_SCM to change behaviour (#240)\n- add stub user docs in lieu of something proper (#238)\n- Remove clone_dir if clone fails\n- python-unittest2 is only required for the optional make check\n- move python-unittest2 dep to test suite only part (submission by olh)\n- Removing redundant pass statement\n- missing import for logging functions.\n- [backend] Adding http proxy support\n- python-unittest2 is only required for the optional make check\n- make installation of scm's optional\n- add a lot more detail to README\n- Git clone with --no-checkout in prepare_working_copy\n- Refactor and simplify git prepare_working_copy\n- Only use current dir if it actually looks like git (Fixes #202)\n- reactivate test_obscpio_extract_d\n- fix broken test create_archive\n- fix broken tests for broken-links\n- changed PREFIX in Gnumakefile to /usr\n- new cli option --skip-cleanup\n- fix for broken links\n- fix reference to snapcraft YAML file\n- fix docstring typo in TarSCM.scm.tar.fetch_upstream\n- acknowledge deficiencies in dev docs\n- wrap long lines in README\n\nThis update was imported from the SUSE:SLE-15:Update update project.\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-03-15T06:52:27Z","modified":"2026-02-04T04:19:31.279745Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:11107-1","title":"obs-service-appimage-0.10.28.1632141620.a8837d3-1.1 on GA media","description":"These are all security issues fixed in the obs-service-appimage-0.10.28.1632141620.a8837d3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:17:31.651239Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:0540-1","title":"Security update for obs-service-tar_scm","description":"This update for obs-service-tar_scm fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2018-12473: Fixed a path traversal issue, which allowed users to access\n  files outside of the repository using relative paths (bsc#1105361)\n- CVE-2018-12474: Fixed an issue whereby crafted service parameters allowed for\n  unexpected behaviour (bsc#1107507)\n- CVE-2018-12476: Fixed an issue whereby the outfilename parameter allowed to\n  write files outside of package directory (bsc#1107944)\n\nOther bug fixes and changes made:\n\n- Prefer UTF-8 locale as output format for changes\n- added KankuFile\n- fix problems with unicode source files\n- added python-six to Requires in specfile\n- better encoding handling\n- fixes bsc#1082696 and bsc#1076410\n- fix unicode in containers\n- move to python3\n- added logging for better debugging changesgenerate\n- raise exception if no changesauthor given\n- Stop using @opensuse.org addresses to indicate a missing address\n- move argparse dep to -common package\n- allow submodule and ssl options in appimage\n- sync spec file as used in openSUSE:Tools project\n- check encoding problems for svn and print proper error msg\n- added new param '--locale'\n- separate service file installation in GNUmakefile\n- added glibc as Recommends in spec file\n- cleanup for broken svn caches\n- another fix for unicode problem in obs_scm\n- Final fix for unicode in filenames\n- Another attempt to fix unicode filenames in prep_tree_for_archive\n- Another attempt to fix unicode filenames in prep_tree_for_archive\n- fix bug with unicode filenames in prep_tree_for_archive\n- reuse _service*_servicedata/changes files from previous service runs\n- fix problems with  unicode characters in commit messages for changeloggenerate\n- fix encoding issues if commit message contains utf8 char\n- revert encoding for old changes file\n- remove hardcoded utf-8 encodings\n- Add support for extract globbing\n- split pylint2 in GNUmakefile\n- fix check for '--reproducible'\n- create reproducible obscpio archives\n- fix regression from 44b3bee\n- Support also SSH urls for Git\n- check name/version option in obsinfo for slashes\n- check url for remote url\n- check symlinks in subdir parameter\n- check filename for slashes\n- disable follow_symlinks in extract feature\n- switch to obs_scm for this package\n- run download_files in appimage and snapcraft case\n- check --extract file path for parent dir\n- Fix parameter descriptions\n- changed os.removedirs -\u003e shutil.rmtree\n- Adding information regarding the *package-metadata* option for the *tar* service The tar service is highly useful in combination with the *obscpio* service. After the fix for the metadata for the latter one, it is important to inform the users of the *tar* service that metadata is kept only if the flag *package-metadata* is enabled. Add the flag to the .service file for mentioning that.\n- Allow metadata packing for CPIO archives when desired As of now, metadata are always excluded from *obscpio* packages. This is because the *package-metadata* flag is ignored; this change (should) make *obscpio* aware of it.\n- improve handling of corrupt git cache directories\n- only do git stash save/pop if we have a non-empty working tree (#228)\n- don't allow DEBUG_TAR_SCM to change behaviour (#240)\n- add stub user docs in lieu of something proper (#238)\n- Remove clone_dir if clone fails\n- python-unittest2 is only required for the optional make check\n- move python-unittest2 dep to test suite only part (submission by olh)\n- Removing redundant pass statement\n- missing import for logging functions.\n- [backend] Adding http proxy support\n- python-unittest2 is only required for the optional make check\n- make installation of scm's optional\n- add a lot more detail to README\n- Git clone with --no-checkout in prepare_working_copy\n- Refactor and simplify git prepare_working_copy\n- Only use current dir if it actually looks like git (Fixes #202)\n- reactivate test_obscpio_extract_d\n- fix broken test create_archive\n- fix broken tests for broken-links\n- changed PREFIX in Gnumakefile to /usr\n- new cli option --skip-cleanup\n- fix for broken links\n- fix reference to snapcraft YAML file\n- fix docstring typo in TarSCM.scm.tar.fetch_upstream\n- acknowledge deficiencies in dev docs\n- wrap long lines in README\n","status":"published","published":"2019-03-04T16:42:47Z","modified":"2026-02-04T03:20:02.91769Z","updated_at":"2026-11-02T15:53:45.926331Z"}]}}