Skip to content
OpenAdvisories
Medium DLA-2545-1 2 CVEs

open-build-service - security update

Published Feb 3, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 open-build-service 2.7.1-10+deb9u1

Vulnerabilities 2

  • Medium 6.5
    CVE-2020-8020

    Persistent XSS in markdown parser used by obs-server

    A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS. This issue affects: openSUSE open-build-service versions prior to 7cc32c8e2ff7290698e101d9a80a9d…

    openSUSE open build service open-build-service open-build-service Debian Ubuntu
  • Medium 5.3
    CVE-2020-8021

    unauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service

    a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is disabled This issue affects: Open Build Service versions prior to 2.10.5.

    openSUSE open build service open-build-service obs-build Debian Ubuntu