crash.spec uses a construct like

%define kver %(rpm -q --qf '%{VERSION}-%{RELEASE}' kernel-source)
%define kver_ %(rpm -q --qf '%{VERSION}_%{RELEASE}' kernel-source)

in the spec file. Wihtout escaping %, there is no guarantee that RPM passes
%{VERSION{ literal to the external rpm comman (which we do, in order to get the
version of the kernel-source package)

Especially with RPM 4.14, the variable %{VERSION} is used internally by RPM
already and results in it being expanded now.

A fix for this had been prepared on Dec 7 by me and submitted to the devel prj,
but ignored ever since.

https://build.opensuse.org/request/show/554974

RPM 4.14 will be landing early 2018