http://bugzilla.opensuse.org/show_bug.cgi?id=1175760 Bug ID: 1175760 Summary: VUL-0: CVE-2020-24614: fossil: remote authenticated users to execute arbitrary code Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/265912/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: max@suse.com Reporter: atoptsoglou@suse.com QA Contact: security-team@suse.de Found By: Security Response Team Blocker: --- CVE-2020-24614 "Researcher Max Justicz discovered a potential RCE and other vulnerabilities in the Fossil distributed version control system. (https://fossil-scm.org/) Patches to address these issues are now available for download. Package maintainers who bundle Fossil are encouraged to update their packages without unnecessary delay. All vulnerabilities require a pre-existing trust relationship between the victim and the attacker. In other words, the attacker must be either a site administrator, or someone with check-in privileges on the project. There are no known vulnerabilities to servers from web users entering tickets or forum messages or wiki or doing other on-line operations. The attacks require the ability to push, at least, and the most serious RCE problem requires the ability to configure a server in malicious ways. If you are unable to upgrade to one of the patched versions of Fossil, then you are encouraged at least to know well the people from whom you clone or pull. Precompiled binaries and source tarballs for the patched versions of Fossil are available on the Fossil download page (http://fossil-scm.org/fossil/uv/download.html). However, the dozens of check-ins that went into generating these patches, and the tickets that describe the specifics of the vulnerabilities, will be embargoed for a few days. See the thread on the Fossil Forum (https://fossil-scm.org/forum/info/a05ae3ce7760daf6) for follow up information or to communicate directly with the Fossil developers." References: https://bugzilla.redhat.com/show_bug.cgi?id=1870789 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24614 http://seclists.org/oss-sec/2020/q3/134 https://www.openwall.com/lists/oss-security/2020/08/20/1 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24614 https://fossil-scm.org/forum/info/a05ae3ce7760daf6 -- You are receiving this mail because: You are on the CC list for the bug.