Description
The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS). In versions prior to 0.5.3-1.1 this script did not properly sanitize the input provided by the user, allowing for code execution on the executing server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openSUSE | obs-service-set_version | unspecified – < 0.5.3-1.1 | 0.5.3-1.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | obs-service-set_version | 0.5.3-4.2 | openSUSE-SU-2024:10108-1 |
Advisories 1
- openSUSE-SU-2024:10108-1 obs-service-set_version-0.5.3-4.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026