CVE-2024-22033
Fixed in a distro release EPSS <1%CVSS 6.3
The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps
Products: SUSE Package Hub 15 SP5, SUSE Package Hub 15 SP6, openSUSE Leap 15.5, openSUSE Leap 15.6, openSUSE Tumbleweed
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| openSUSE Tumbleweed | obs-service-download_url | 0.2.1-1.1 |