Description
osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log or (2) build status that contains an escape sequence for a terminal emulator.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | osc | 0.134.0-1 | — |
| Debian 13 | osc | 0.134.0-1 | — |
| Debian 12 | osc | 0.134.0-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | osc | 0.155.1-2.1 | openSUSE-SU-2024:10133-1 |
Advisories 1
- openSUSE-SU-2024:10133-1 osc-0.155.1-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [oss-security] 20120301 Re: Re: CVE Request (minor) -- osc: Improper sanitization of terminal emulator escape sequences when displaying build log and build status mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=798353
- [oss-security] 20120228 Re: CVE Request (minor) -- osc: Improper sanitization of terminal emulator escape sequences when displaying build log and build status mailing-list
- https://bugzilla.novell.com/show_bug.cgi?id=749335
- [oss-security] 20120228 CVE Request (minor) -- osc: Improper sanitization of terminal emulator escape sequences when displaying build log and build status mailing-list
- openSUSE-SU-2012:0400 vendor-advisory