CVE-2024-22034 - CVE House

Status published Medium CVE-2024-22034

Crafted projects can overwrite special files in the .osc config directory

5.5 CVSS

Vulnerability Description

Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-22034

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Daniel Mach of SUSE

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22034

More from SUSE

View All →

CVE-2025-8412

VMDP: Potential buffer overflow in the RtlQueryRegistryValues function

Low 2

CVE-2025-8077

NeuVector admin account has insecure default password

Critical 9.8

CVE-2025-71261

Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS

High 8.6

CVE-2025-67860

NeuVector scanner insecurely handles passwords as command arguments

Low 3.8

CVE-2025-67601

Rancher CLI skips TLS verification on Rancher CLI login command

High 8.3

Affected Vendor

SUSE

View all reports →

Affected Software

SUSE Linux Enterprise Desktop 15 SP5, SUSE Linux Enterprise High Performance Computing 15 SP5, SUSE Linux Enterprise Module for Development Tools 15 SP5, SUSE Linux Enterprise Server 15 SP5, SUSE Linux Enterprise Server for SAP Applications 15 SP5, SUSE Linux Enterprise Desktop 15 SP6, SUSE Linux Enterprise High Performance Computing 15 SP6, SUSE Linux Enterprise Module for Development Tools 15 SP6, SUSE Linux Enterprise Server 15 SP6, SUSE Linux Enterprise Server for SAP Applications 15 SP6, SUSE Linux Enterprise Server 12 SP5, SUSE Linux Enterprise Server for SAP Applications 12 SP5, SUSE Linux Enterprise Software Development Kit 12 SP5, openSUSE Leap 15.5, openSUSE Leap 15.6, openSUSE Tumbleweed

Vulnerable Versions:

Timeline

Official Publish: October 16th, 2024

Last Modified: October 31st, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.