CVE-2018-7688 : Security Advisory and Response

Open Build Service accepts arbitrary reviews.

Understanding CVE-2018-7688

The absence of a permission check in the review handling feature of openSUSE Open Build Service prior to version 2.9.3 enabled any authenticated user to alter sources in projects for which they do not possess write permissions.

What is CVE-2018-7688?

CVE-2018-7688 is a vulnerability in Open Build Service that allowed authenticated users to modify sources in projects without write permissions.

The Impact of CVE-2018-7688

The vulnerability had a CVSS base score of 7.1, with high severity due to the potential for unauthorized source alterations by authenticated users.

Technical Details of CVE-2018-7688

Vulnerability Description

A missing permission check in the review handling feature of openSUSE Open Build Service before version 2.9.3 allowed all authenticated users to modify sources in projects where they lacked write permissions.

Affected Systems and Versions

Product: Open Build Service
Vendor: openSUSE
Versions Affected: < 2.9.3

Exploitation Mechanism

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Integrity Impact: High
Availability Impact: Low
Confidentiality Impact: None

Mitigation and Prevention

Immediate Steps to Take

Upgrade Open Build Service to version 2.9.3 or newer.
Implement strict access controls and permissions within the Open Build Service environment.

Long-Term Security Practices

Regularly review and update access control policies.
Conduct security training for users to raise awareness of proper source modification practices.

Patching and Updates

Stay informed about security updates and patches released by openSUSE.