CVE-2019-3681: osc: stores downloaded (supposed) RPM in network-controlled filesystem paths

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-06-29 · updated 2026-06-17
Weakness: CWE-73

Description

A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc versions prior to 0.169.0 .

Affected products

openSUSE Osc: before 0.169.1-3.20.1; before 0.162.1-15.9.1; before 0.169.1-lp151.2.15.1; before 0.169.0 — fixed in 0.162.1-15.9.1, 0.169.0, 0.169.1-3.20.1, 0.169.1-lp151.2.15.1

How to fix

Upgrade to a fixed version: openSUSE Osc 0.162.1-15.9.1, 0.169.0, 0.169.1-3.20.1, 0.169.1-lp151.2.15.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-3681 or the next vulnerability affects your stack