open-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions

Published 8 y ago 2018-03-01 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.4

v3.0 · CNA

CISA KEV

not known exploited

EPSS

0.6%

percentile 49%

Public exploits

none known

In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of service (resource consumption).

Exploit prediction (EPSS)

0.60% probability of exploitation in the next 30 days, higher than 49% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	4.4	`CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L`
CNA	3.0	4.4	`CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L`
NVD	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
NVD	2.0	4.0	`AV:N/AC:L/Au:S/C:N/I:N/A:P`

Affected products

SUSE open build service

Classification

Weakness

CWE-285 Improper Authorization
CWE-732 Incorrect Permission Assignment for Critical Resource

References

bugzilla.suse.com /show_bug.cgi?id=1045519 · x_refsource_CONFIRM, x_transferred
github.com /openSUSE/open-build-service/pull/3267 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2017-9268
NVD: CVE-2017-9268

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.