{"id":"CVE-2024-22034","aliases":["DEBIAN-CVE-2024-22034","EUVD-2024-19638","GHSA-gm3v-m2w5-wm38","OESA-2024-2133","SUSE-SU-2024:2961-1","SUSE-SU-2024:2963-1","UBUNTU-CVE-2024-22034","openSUSE-SU-2024:14277-1"],"status":"published","title":"Crafted projects can overwrite special files in the .osc config directory","description":"Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00209,"percentile":0.11219,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-08-19T12:06:41Z","modified":"2026-11-02T12:00:43Z","fixes":[{"ecosystem":"Debian:13","package":"osc","fixed_in":["1.9.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"osc","fixed_in":["1.9.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"osc","fixed_in":["0.177.0-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"osc","fixed_in":["0.177.0-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"osc","fixed_in":["0.169.1-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"osc","fixed_in":["0.177.0-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"osc","fixed_in":["1.9.1-1.oe2403"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"osc","fixed_in":["1.9.0-150400.10.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"osc","fixed_in":["1.9.0-150400.10.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"osc","fixed_in":["1.9.0-150400.10.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"osc","fixed_in":["1.9.0-150400.10.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"osc","fixed_in":["0.183.0-15.18.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"osc","fixed_in":["1.9.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.169.1-2","0.182.1-1","1.10.1-1","1.11.1-1","1.12.0-1","1.12.1-1","1.12.1-2","1.15.1-1","1.7.0-1","1.7.0-2","1.7.0-3","1.7.0-4","1.7.0-5","1.8.3-1","1.9.0-1","1.9.1-1","1.9.1-2","1.9.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.177.0-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.177.0-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.169.1-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.177.0-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-1.oe2403"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-150400.10.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-150400.10.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-150400.10.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-150400.10.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.183.0-15.18.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.152.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.159.0-1","0.160.0-1","0.161.1-1","0.162.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.164.2-1","0.164.2-1build1","0.165.4-1","0.167.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.169.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.169.1-2","0.169.1-2ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-1.1"}]}]}],"products":[{"vendor":"suse","product":"opensuse leap 15.5"},{"vendor":"suse","product":"opensuse leap 15.6"},{"vendor":"suse","product":"opensuse tumbleweed"},{"vendor":"suse","product":"suse linux enterprise desktop 15 sp5"},{"vendor":"suse","product":"suse linux enterprise desktop 15 sp6"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15 sp5"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15 sp6"},{"vendor":"suse","product":"suse linux enterprise module for development tools 15 sp5"},{"vendor":"suse","product":"suse linux enterprise module for development tools 15 sp6"},{"vendor":"suse","product":"suse linux enterprise server 12 sp5"},{"vendor":"suse","product":"suse linux enterprise server 15 sp5"},{"vendor":"suse","product":"suse linux enterprise server 15 sp6"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 12 sp5"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 15 sp5"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 15 sp6"},{"vendor":"suse","product":"suse linux enterprise software development kit 12 sp5"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22034","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22034","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gm3v-m2w5-wm38"},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-22034","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2133","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242961-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1122683","tags":["report"]},{"url":"https://bugzilla.suse.com/1212476","tags":["report"]},{"url":"https://bugzilla.suse.com/1218170","tags":["report"]},{"url":"https://bugzilla.suse.com/1221340","tags":["report"]},{"url":"https://bugzilla.suse.com/1225911","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22034","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242963-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-22034","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22034","tags":["report"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1225911","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-22034","title":"Crafted projects can overwrite special files in the .osc config directory","description":"Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim","status":"published","published":"2024-10-16T13:46:08.416Z","modified":"2024-10-31T13:34:34.435Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:34:00.254134Z"}],"euvd":[{"id":"EUVD-2024-19638","description":"Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim","status":"published","published":"2024-10-16T13:46:08Z","modified":"2024-10-31T13:34:34Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:05:13.496556Z"}],"ghsa":[{"id":"GHSA-gm3v-m2w5-wm38","title":"Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl)....","description":"Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim","status":"published","published":"2024-10-16T15:32:07Z","modified":"2024-10-16T15:32:14Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T14:58:31.476115Z"}],"nvd":[{"id":"CVE-2024-22034","description":"Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim","status":"published","published":"2024-10-16T14:15:05.577Z","modified":"2026-06-17T07:10:34.907Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:10:32.45889Z"}],"osv":[{"id":"DEBIAN-CVE-2024-22034","description":"Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim","status":"published","published":"2024-10-16T14:15:05.577Z","modified":"2026-11-02T12:00:43.880125906Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"OESA-2024-2133","title":"osc security update","description":"The osc is an opensuse-commander with svn like handling. It\u0026apos;s a command line interface to work with an Open Build Service.\n\nSecurity Fix(es):\n\n(CVE-2024-22034)","status":"published","published":"2024-09-14T11:07:36Z","modified":"2026-08-18T01:17:32.81382511Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2024-22034","description":"Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim","status":"published","published":"2024-10-16T14:15:00Z","modified":"2025-10-24T05:06:51Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"CVE-2024-22034","description":"Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim","status":"published","published":"2024-10-16T14:15:05Z","modified":"2026-04-10T05:09:03.522784Z","updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"openSUSE-SU-2024:14277-1","title":"osc-1.9.0-1.1 on GA media","description":"These are all security issues fixed in the osc-1.9.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-20T00:00:00Z","modified":"2026-02-04T02:37:14.048122Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:2961-1","title":"Security update for osc","description":"This update for osc fixes the following issues:\n\n- 1.9.0\n  - Security:\n    - Fix possibility to overwrite special files in .osc (CVE-2024-22034 bsc#1225911)\n      Source files are now stored in the 'sources' subdirectory which prevents\n      name collisons. This requires changing version of '.osc' store to 2.0.\n  - Command-line:\n    - Introduce build --checks parameter\n  - Library:\n    - OscConfigParser: Remove automatic __name__ option\n\n- 1.8.3\n  - Command-line:\n    - Change 'repairwc' command to always run all repair steps\n  - Library:\n    - Make most of the fields in KeyinfoPubkey and KeyinfoSslcert models optional\n    - Fix colorize() to avoid wrapping empty string into color escape sequences\n    - Provide default values for kwargs.get/pop in get_results() function\n\n- 1.8.2\n  - Library:\n    - Change 'repairwc' command to fix missing .osc/_osclib_version\n    - Make error message in check_store_version() more generic to work for both projects and packages\n    - Fix check_store_version in project store\n\n- 1.8.1\n  - Command-line:\n    - Fix 'linkpac' command crash when used with '--disable-build' or '--disable-publish' option\n\n- 1.8.0\n  - Command-line:\n    - Improve 'submitrequest' command to inherit description from superseded request\n    - Fix 'mv' command when renaming a file multiple times\n    - Improve 'info' command to support projects\n    - Improve 'getbinaries' command by accepting '-M' / '--multibuild-package' option outside checkouts\n    - Add architecture filtering to 'release' command\n    - Change 'results' command so the normal and multibuild packages have the same output\n    - Change 'results' command to use csv writer instead of formatting csv as string\n    - Add couple mutually exclusive options errors to 'results' command\n    - Set a default value for 'results --format' only for the csv output\n    - Add support for 'results --format' for the default text mode\n    - Update help text for '--format' option in 'results' command\n    - Add 'results --fail-on-error/-F' flag\n    - Redirect venv warnings from stderr to debug output\n  - Configuration:\n    - Fix config parser to throw an exception on duplicate sections or options\n    - Modify conf.get_config() to print permissions warning to stderr rather than stdout\n  - Library:\n    - Run check_store_version() in obs_scm.Store and fix related code in Project and Package\n    - Forbid extracting files with absolute path from 'cpio' archives (bsc#1122683)\n    - Forbid extracting files with absolute path from 'ar' archives (bsc#1122683)\n    - Remove no longer valid warning from core.unpack_srcrpm()\n    - Make obs_api.KeyinfoSslcert keyid and fingerprint fields optional\n    - Fix return value in build build.create_build_descr_data()\n    - Fix core.get_package_results() to obey 'multibuild_packages' argument\n  - Tests:\n    - Fix tests so they don't modify fixtures\n\n- 1.7.0\n  - Command-line:\n    - Add 'person search' command\n    - Add 'person register' command\n    - Add '-M/--multibuild-package' option to '[what]dependson' commands\n    - Update '-U/--user' option in 'maintainer' command to accept also an email address\n    - Fix 'branch' command to allow using '--new-package' option on packages that do not exist\n    - Fix 'buildinfo' command to include obs:cli_debug_packages by default\n    - Fix 'buildinfo' command to send complete local build environment as the 'build' command does\n    - Fix 'maintainer --devel-project' to raise an error if running outside a working copy without any arguments\n    - Fix handling arguments in 'service remoterun prj/pac'\n    - Fix 'rebuild' command so the '--all' option conflicts with the 'package' argument\n    - Fix crash when removing 'scmsync' element from dst package meta in 'linkpac' command\n    - Fix crash when reading dst package meta in 'linkpac' command\n    - Allow `osc rpmlint` to infer prj/pkg from CWD\n    - Propagate exit code from the run() and do_() commandline methods\n    - Give a hint where a scmsync git is hosted\n    - Fix crash in 'updatepacmetafromspec' command when working with an incomplete spec\n    - Improve 'updatepacmetafromspec' command to expand rpm spec macros by calling rpmspec to query the data\n    - Improve 'build' and 'buildinfo' commands by uploading *.inc files to OBS for parsing BuildRequires (bsc#1221340)\n    - Improve 'service' command by printing names of running services\n    - Improve 'getbinaries' command by ignoring source and debuginfo filters when a binary name is specified\n    - Change 'build' command to pass '--jobs' option to 'build' tool only if 'build_jobs' \u003e 0\n    - Clarify 'list' command's help that that listing binaries doesn't contain md5 checksums\n    - Improve 'log' command: produce proper CSV and XML outputs, add -p/--patch option for the text output\n    - Allow setlinkrev to set a specific vrev\n    - Document '--buildtool-opt=--noclean' example in 'build' command's help\n    - Fix handling the default package argument on the command-line\n  - Configuration:\n    - Document loading configuration from env variables\n  - Connection:\n    - Don't retry on error 400\n    - Remove now unused 'retry_on_400' http_request() option from XmlModel\n    - Revert 'Don't retry on 400 HTTP status code in core.server_diff()'\n    - Revert 'connection: Allow disabling retry on 400 HTTP status code'\n  - Authentication:\n    - Update SignatureAuthHandler to support specifying ssh key by its fingerprint\n    - Use ssh key from ssh agent that contains comment 'obs=\u003capiurl-hostname\u003e'\n    - Use strings instead of bytes in SignatureAuthHandler\n    - Cache password from SecretService to avoid spamming user with an accept dialog\n    - Never ask for credentials when displaying help\n    - Remove unused SignatureAuthHandler.get_fingerprint()\n  - Library:\n    - Add rootless build support for 'qemu' VM type\n    - Support package linking of packages from scmsync projects\n    - Fix do_createrequest() function to return None instead of request id\n    - Replace invalid 'if' with 'elif' in BaseModel.dict()\n    - Fix crash when no prefered packages are defined\n    - Add XmlModel class that encapsulates manipulation with XML\n    - Add obs_api.Person.cmd_register() for registering new users\n    - Fix conf.get_config() to ignore file type bits when comparing oscrc perms\n    - Fix conf.get_config() to correctly handle overrides when env variables are set\n    - Fix output.tty.IS_INTERACTIVE when os.isatty() throws OSError\n    - Improve cmdln.HelpFormatter to obey newline characters\n    - Update list of color codes in 'output.tty' module\n    - Remove core.setDevelProject() in favor of core.set_devel_project()\n    - Move removing control characters to output.sanitize_text()\n    - Improve sanitize_text() to keep selected CSI escape sequences\n    - Add output.pipe_to_pager() that pipes lines to a pager without creating an intermediate temporary file\n    - Fix output.safe_write() in connection with NamedTemporaryFile\n    - Modernize output.run_pager()\n    - Extend output.print_msg() to accept 'error' and 'warning' values of 'to_print' argument\n    - Add XPathQuery class for translating keyword arguments to an xpath query\n    - Add obs_api.Keyinfo class\n    - Add obs_api.Package class\n    - Add Package.get_revision_list() for listing commit log\n    - Add obs_api.PackageSources class for handling OBS SCM sources\n    - Add obs_api.Person class\n    - Add obs_api.Project class\n    - Add obs_api.Request class\n    - Add obs_api.Token class\n    - Allow storing apiurl in the XmlModel instances\n    - Allow retrieving default field value from top-level model\n    - Fix BaseModel to convert dictionaries to objects on retrieving a model list\n    - Fix BaseModel to always deepcopy mutable defaults on first use\n    - Implement do_snapshot() and has_changed() methods to determine changes in BaseModel\n    - Implement total ordering on BaseModel\n    - Add comments with available attributes/elements to edited XML\n  - Refactoring:\n    - Migrate repo {list,add,remove} commands to obs_api.Project\n    - Migrate core.show_package_disabled_repos() to obs_api.Package\n    - Migrate core.Package.update_package_meta() to obs_api.Package\n    - Migrate core.get_repos_of_project() to obs_api.Project\n    - Migrate core.get_repositories_of_project() to obs_api.Project\n    - Migrate core.show_scmsync() to obs_api.{Package,Project}\n    - Migrate core.set_devel_project() to obs_api.Package\n    - Migrate core.show_devel_project() to obs_api.Package\n    - Migrate Fetcher.run() to obs_api.Keyinfo\n    - Migrate core.create_submit_request() to obs_api.Request\n    - Migrate 'token' command to obs_api.Token\n    - Migrate 'whois/user' command to obs_api.Person\n    - Migrate 'signkey' command to obs_api.Keyinfo\n    - Move print_msg() to the 'osc.output' module\n    - Move run_pager() and get_default_pager() from 'core' to 'output' module\n    - Move core.Package to obs_scm.Package\n    - Move core.Project to obs_scm.Project\n    - Move functions manipulating store from core to obs_scm.store\n    - Move store.Store to obs_scm.Store\n    - Move core.Linkinfo to obs_scm.Linkinfo\n    - Move core.Serviceinfo to obs_scm.Serviceinfo\n    - Move core.File to obs_scm.File\n    - Merge _private.project.ProjectMeta into obs_api.Project\n  - Spec:\n    - Remove dependency on /usr/bin/python3 using %python3_fix_shebang macro (bsc#1212476)\n\n- 1.6.2\n  - Command-line:\n    - Fix 'branch' command to allow using '--new-package' option on packages that do not exist\n    - Fix 'buildinfo' command to include obs:cli_debug_packages by default\n    - Fix 'buildinfo' command to send complete local build environment as the 'build' command does\n    - Allow `osc rpmlint` to infer prj/pkg from CWD\n    - Propagate exit code from the run() and do_() commandline methods\n    - Give a hint where a scmsync git is hosted\n    - Fix crash in 'updatepacmetafromspec' command when working with an incomplete spec\n  - Authentication:\n    - Cache password from SecretService to avoid spamming user with an accept dialog\n    - Never ask for credentials when displaying help\n  - Library:\n    - Support package linking of packages from scmsync projects\n    - Fix do_createrequest() function to return None instead of request id\n    - Replace invalid 'if' with 'elif' in BaseModel.dict()\n    - Fix crash when no prefered packages are defined\n\n- 1.6.1\n  - Command-line:\n    - Use busybox compatible commands for completion\n    - Change 'wipe' command to use the new get_user_input() function\n    - Fix error 500 in running 'meta attribute \u003cprj\u003e'\n  - Configuration:\n    - Fix resolving config symlink to the actual config file\n    - Honor XDG_CONFIG_HOME and XDG_CACHE_HOME env vars\n    - Warn about ignoring XDG_CONFIG_HOME and ~/.config/osc/oscrc if ~/.oscrc exists\n  - Library:\n    - Error out when branching a scmsync package\n    - New get_user_input() function for consistent handling of user input\n    - Move xml_indent, xml_quote and xml_unquote to osc.util.xml module\n    - Refactor makeurl(), deprecate query taking string or list arguments, drop osc_urlencode()\n    - Remove all path quoting, rely on makeurl()\n    - Always use dict query in makeurl()\n    - Fix core.slash_split() to strip both leading and trailing slashes\n\n- 1.6.0\n  - Command-line:\n    - The 'token --trigger' command no longer sets '--operation=runservice' by default.\n    - Change 'token --create' command to require '--operation'\n    - Fix 'linkdiff' command error 400: prj/pac/md5 not in repository\n    - Update 'build' command to support building 'productcompose' build type with updateinfo.xml data\n    - Don't show meter in terminals that are not interactive\n    - Fix traceback when running osc from an arbitrary git repo that fails to map branch to a project (bsc#1218170)\n  - Configuration:\n    - Implement reading credentials from environmental variables\n    - Allow starting with an empty config if --configfile is either empty or points to /dev/null\n    - Implement 'quiet' conf option\n    - Password can be an empty string (commonly used with ssh auth)\n  - Connection:\n    - Allow -X HEAD on osc api requests as well\n  - Library:\n    - Fix credentials managers to consistently return Password\n    - Fix Password.encode() on python \u003c 3.8\n    - Refactor 'meter' module, use config settings to pick the right class\n    - Convert to using f-strings\n    - Use Field.get_callback to handle quiet/verbose and http_debug/http_full_debug options\n    - Implement get_callback that allows modifying returned value to the Field class\n    - Add support for List[BaseModel] type to Field class\n    - Report class name when reporting an error during instantiating BaseModel object\n    - Fix exporting an empty model field in  BaseModel.dict()\n    - Fix initializing a sub-model instance from a dictionary\n    - Implement 'Enum' support in models\n    - Fix Field.origin_type for Optional types\n    - Drop unused 'exclude_unset' argument from BaseModel.dict() method\n    - Store cached model defaults in self._defaults, avoid sharing references to mutable defaults\n    - Limit model attributes to predefined fields by forbidding creating new attributes on fly\n    - Store model values in self._values dict instead of private attributes\n  - Spec:\n    - Recommend openssh-clients for ssh-add that is required during ssh auth\n    - Add 0%{?amzn} macro that wasn't usptreamed\n","status":"published","published":"2024-08-19T12:06:41Z","modified":"2026-02-04T04:37:53.676571Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2963-1","title":"Security update for osc","description":"This update for osc fixes the following issues:\n\n0.183.0\n  - Fix possibility to overwrite special files in .osc (CVE-2024-22034 bsc#1225911)\n    Source files are now stored in the 'sources' subdirectory which prevents\n    name collisons. This requires changing version of '.osc' store to 2.0.\n  - Fix errorneous double quotes in core.py\n","status":"published","published":"2024-08-19T12:06:57Z","modified":"2026-02-04T03:55:00.640385Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}