PT-2018-2217 · Yum+2 · Yum-Utils+2

Dmnks · Published 2018-07-30 · Updated 2023-02-13 · CVE-2018-10897

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions yum-utils versions 1.1.31 and older

Description A directory traversal issue exists in reposync, a part of yum-utils, due to insufficient path sanitization in remote repository configuration files. This allows an attacker controlling a repository to potentially copy files outside the destination directory on a targeted system via path traversal. If reposync runs with heightened privileges, this flaw could result in system compromise by overwriting critical system files. The issue may enable a remote attacker to create, modify, or delete arbitrary files.

Recommendations For versions 1.1.31 and older, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Path traversal

Weakness Enumeration

CWE-59

CWE-22

Related Identifiers

BDU:2019-00254

CESA-2018_2284

CESA-2018_2285

CVE-2018-10897

RHSA-2018:2284

RHSA-2018:2285

RHSA-2018:2626

RHSA-2018_2284

RHSA-2018_2285

Affected Products

Centos

Red Hat

Yum-Utils

References · 18

• https://github.com/rpm-software-management/yum-utils/commit/7554c0133eb830a71dc01846037cc047d0acbc2c · Patch
• https://github.com/rpm-software-management/yum-utils/commit/6a8de061f8fdc885e74ebe8c94625bf53643b71c · Patch
• https://access.redhat.com/errata/RHSA-2018:2284 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2018-2284.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10897 · Patch
• https://access.redhat.com/errata/RHSA-2018:2626 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10897 · Security Note
• https://bdu.fstec.ru/vul/2019-00254 · Security Note
• https://access.redhat.com/errata/RHSA-2018:2285 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-10897 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2018-2285.html · Vendor Advisory
• https://github.com/rpm-software-management/yum-utils/pull/43 · Note
• http://securitytracker.com/id/1041594 · Note
• https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 · Note
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10917&cat=SIRT_1&actp=LIST · Note