CVE-2019-3685

Name of the Vulnerable Software and Affected Versions Open Build Service versions prior to 0.165.4

Description The issue is related to errors in certificate authentication. It may allow a remote attacker to bypass existing security restrictions and implement a "man-in-the-middle" attack. The problem arises because Open Build Service before version 0.165.4 did not validate TLS certificates for HTTPS connections with the osc client binary.

Recommendations For versions prior to 0.165.4, update to version 0.165.4 or later to resolve the issue. As a temporary workaround, consider disabling the use of HTTPS connections with the osc client binary until a patch is available. Restrict access to sensitive operations to minimize the risk of exploitation.