Debian Security Advisory
DLA-2545-1 open-build-service -- LTS security update
- Date Reported:
- 03 Feb 2021
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2020-8020, CVE-2020-8021.
- More information:
An improper neutralization of input during web page generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS.
An improper access control vulnerability in open-build-service allows remote attackers to read files of an OBS package where the sourceaccess/access is disabled.
For Debian 9 stretch, these problems have been fixed in version 2.7.1-10+deb9u1.
We recommend that you upgrade your open-build-service packages.
For the detailed security status of open-build-service please refer to its security tracker page at: https://security-tracker.debian.org/tracker/open-build-service
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS