CVE-2024-22034
Medium
Description
Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim
SeverityMedium
CVSS5.5
Exploit probability—
Product
SUSE Linux Enterprise Desktop 15 SP5
PublishedOct 16, 2024
First seenOct 16, 2024
How to fix
Update
- SUSE SUSE Linux Enterprise Desktop 15 SP51.9.0-150400.10.6.1 or later
- SUSE SUSE Linux Enterprise High Performance Computing 15 SP51.9.0-150400.10.6.1 or later
- SUSE SUSE Linux Enterprise Module for Development Tools 15 SP51.9.0-150400.10.6.1 or later
- SUSE SUSE Linux Enterprise Server 15 SP51.9.0-150400.10.6.1 or later
- SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP51.9.0-150400.10.6.1 or later
- SUSE SUSE Linux Enterprise Desktop 15 SP61.9.0-150400.10.6.1 or later
- SUSE SUSE Linux Enterprise High Performance Computing 15 SP61.9.0-150400.10.6.1 or later
- SUSE SUSE Linux Enterprise Module for Development Tools 15 SP61.9.0-150400.10.6.1 or later
- SUSE SUSE Linux Enterprise Server 15 SP61.9.0-150400.10.6.1 or later
- SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP61.9.0-150400.10.6.1 or later
- SUSE SUSE Linux Enterprise Server 12 SP50.183.0-15.18.1 or later
- SUSE SUSE Linux Enterprise Server for SAP Applications 12 SP50.183.0-15.18.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SUSE SUSE Linux Enterprise Desktop 15 SP5 | ? ≤ v < 1.9.0-150400.10.6.1 | 1.9.0-150400.10.6.1 |
| SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 | ? ≤ v < 1.9.0-150400.10.6.1 | 1.9.0-150400.10.6.1 |
| SUSE SUSE Linux Enterprise Module for Development Tools 15 SP5 | ? ≤ v < 1.9.0-150400.10.6.1 | 1.9.0-150400.10.6.1 |
| SUSE SUSE Linux Enterprise Server 15 SP5 | ? ≤ v < 1.9.0-150400.10.6.1 | 1.9.0-150400.10.6.1 |
| SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP5 | ? ≤ v < 1.9.0-150400.10.6.1 | 1.9.0-150400.10.6.1 |
| SUSE SUSE Linux Enterprise Desktop 15 SP6 | ? ≤ v < 1.9.0-150400.10.6.1 | 1.9.0-150400.10.6.1 |
| SUSE SUSE Linux Enterprise High Performance Computing 15 SP6 | ? ≤ v < 1.9.0-150400.10.6.1 | 1.9.0-150400.10.6.1 |
| SUSE SUSE Linux Enterprise Module for Development Tools 15 SP6 | ? ≤ v < 1.9.0-150400.10.6.1 | 1.9.0-150400.10.6.1 |
| SUSE SUSE Linux Enterprise Server 15 SP6 | ? ≤ v < 1.9.0-150400.10.6.1 | 1.9.0-150400.10.6.1 |
| SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP6 | ? ≤ v < 1.9.0-150400.10.6.1 | 1.9.0-150400.10.6.1 |
| SUSE SUSE Linux Enterprise Server 12 SP5 | ? ≤ v < 0.183.0-15.18.1 | 0.183.0-15.18.1 |
| SUSE SUSE Linux Enterprise Server for SAP Applications 12 SP5 | ? ≤ v < 0.183.0-15.18.1 | 0.183.0-15.18.1 |
| SUSE SUSE Linux Enterprise Software Development Kit 12 SP5 | ? ≤ v < 0.183.0-15.18.1 | 0.183.0-15.18.1 |
| SUSE openSUSE Leap 15.5 | ? ≤ v < 1.9.0-150400.10.6.1 | 1.9.0-150400.10.6.1 |
| SUSE openSUSE Leap 15.6 | ? ≤ v < 1.9.0-150400.10.6.1 | 1.9.0-150400.10.6.1 |
| SUSE openSUSE Tumbleweed | ? ≤ v < 1.9.0-1.1 | 1.9.0-1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.