CVE-2017-5188 OBS worker VM escape via relative symbolic links
HighCVSS 7.5
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/open-build-service(Debian:12) | < 2.7.4-3 | 2.7.4-3 |
| openSUSE open build service | <= 2.7.3 | No fix listed |
| openSUSE open build service | < 20170320 | 20170320 |
References
- Debian Security Tracker CVE-2017-5188 vendor-advisory
- bugzilla.suse.com
- github.com
- www.suse.com
- bugs.debian.org issue-tracking