Vulnerability · Published May 19, 2020 · Assigned by suse
CVE-2020-8021unauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service
Medium 5.3
In plain English
A medium-severity privilege mismanagement in Open Build Service from openSUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.3%top 29.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is disabled This issue affects: Open Build Service versions prior to 2.10.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | open-build-service | 2.9.4-4 | DEBIAN-CVE-2020-8021 |
| Ubuntu:22.04:LTS | obs-build | no fix listed | UBUNTU-CVE-2020-8021 |
| Ubuntu:25.10 | obs-build | no fix listed | UBUNTU-CVE-2020-8021 |
| Ubuntu:26.10 | obs-build | no fix listed | UBUNTU-CVE-2020-8021 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| openSUSE | Open Build Service | Open Build Service – before 2.10.5 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://bugzilla.suse.com/show_bug.cgi?id=1171649 x_refsource_CONFIRM
- [debian-lts-announce] 20210203 [SECURITY] [DLA 2545-1] open-build-service security update mailing-list, x_refsource_MLIST