CVE-2020-8021: 
Linux Debian vulnerability analysis and mitigation

A vulnerability identified as CVE-2020-8021 was discovered in Open Build Service (OBS), affecting versions prior to 2.10.5. The vulnerability is classified as an Improper Access Control issue that allows remote attackers to read files of an OBS package where the sourceaccess/access is disabled (SUSE Bugzilla, Debian LTS).

The vulnerability stems from an improper access control mechanism in the OBS system that could be exploited through a crafted _service file. The issue was discovered by Marcus Hüwe and reported through the SUSE bugzilla system. The vulnerability is classified under CWE-269 (Improper Privilege Management) (SUSE Bugzilla).

The vulnerability allows unauthorized users to gain read-only access to files in OBS packages where sourceaccess/access has been explicitly disabled. This bypasses intended access restrictions and could potentially expose sensitive information (SUSE Bugzilla, Debian LTS).

The vulnerability can be exploited by an unprivileged user through a specially crafted _service file to access files that should be restricted. The exploit was documented and confirmed by the original reporter (SUSE Bugzilla).

The vulnerability was fixed in Open Build Service version 2.10.5 and backported to various distributions. For Debian 9 (stretch), the fix was implemented in version 2.7.1-10+deb9u1. The fix involves preventing the creation of a _link in mergeservicerun, as implemented in commit 7323c904f86ba9e04065c23422d06c03647589fb (SUSE Bugzilla, Debian LTS).