PT-2018-8240 · Open Build Service · Open Build Service

Andreas Stieger · Publicado 2018-03-01 · Atualizado 2019-10-09 · CVE-2017-5188

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: open build service versions prior to 20170320

Description: The issue allows reading of files outside of the package source directory during build, potentially leading to leakage of private information. This is due to the bs worker code following relative symlinks.

Recommendations: For versions prior to 20170320, update to a version 20170320 or later to resolve the issue.

Correção

Information Disclosure

Link Following

Enumeração de Fraquezas

CWE-200

CWE-59

Identificadores relacionados

CVE-2017-5188

Produtos afetados

Open Build Service

Referências · 11

• https://github.com/openSUSE/open-build-service/commit/ba27c91351878bc297ec4baba0bd488a2f3b568d · Nota
• https://github.com/openSUSE/open-build-service/commit/8595d06570ded81d8514c8c5a147b250541bf388 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5188 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-5188 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5188 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-5188 · Aviso do Fabricante
• https://suse.com/de-de/security/cve/CVE-2017-5188 · Nota
• https://bugzilla.suse.com/show_bug.cgi?id=1029824 · Nota
• https://cve.org/CVERecord?id=CVE-2017-5188 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-5188 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-5188 · Aviso do Fabricante