A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services
An attacker who is able to provide a malicious _service file to the Open Build Service system can place a specially crafted payload in it that exploits the vulnerable Mercurial handler. The tar_scm service during processing of such a file does not properly sanitize input data (CWE-78 — command injection), allowing shellcode injection. The malicious code is executed in the context of the source service process or a local user who checks out the service containing the malicious configuration.
An attacker can execute arbitrary code as a source service process or in the context of a local user processing a malicious _service file, which may lead to complete system takeover, data disclosure, and violation of data integrity and availability.
Update obs-service-tar_scm to version 0.12.4 or later. Patch details are available in vendor references (pull request #552 in the openSUSE/obs-service-tar_scm repository).
obs-service-tar_scm before version 0.12.4 — affects Open Build Service instances using the Mercurial handler in the tar_scm service
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H