CVE-2017-14804 package builds could use directory traversal to write outside of target area
MediumCVSS 5.3
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/obs-build(Debian:12) | < 20180302-1 | 20180302-1 |
| debian/obs-build(Debian:13) | < 20180302-1 | 20180302-1 |
| debian/obs-build(Debian:14) | < 20180302-1 | 20180302-1 |
| SUSE linux enterprise software development kit | = 11-sp4 | No fix listed |
| SUSE linux enterprise software development kit | = 12-sp2 | No fix listed |
| SUSE linux enterprise software development kit | = 12-sp3 | No fix listed |
| openSUSE leap | = 42.2 | No fix listed |
| openSUSE leap | = 42.3 | No fix listed |
| SUSE build | <= 20171128 | No fix listed |
References
- Debian Security Tracker CVE-2017-14804 vendor-advisory
- SUSE-SU-2017:3253 vendor-advisory
- openSUSE-SU-2017:3259 vendor-advisory
- SUSE-SU-2018:0065 vendor-advisory
- bugs.debian.org issue-tracking