PT-2018-8240 · Open Build Service · Open Build Service

Andreas Stieger · Published 2018-03-01 · Updated 2019-10-09 · CVE-2017-5188

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: open build service versions prior to 20170320

Description: The issue allows reading of files outside of the package source directory during build, potentially leading to leakage of private information. This is due to the bs worker code following relative symlinks.

Recommendations: For versions prior to 20170320, update to a version 20170320 or later to resolve the issue.

Fix

Information Disclosure

Link Following

Weakness Enumeration

CWE-200

CWE-59

Related Identifiers

CVE-2017-5188

Affected Products

Open Build Service

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2017-5188 · Security Note
• https://ubuntu.com/security/CVE-2017-5188 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5188 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5188 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5188 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-5188 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-5188 · Vendor Advisory
• https://github.com/openSUSE/open-build-service/commit/ba27c91351878bc297ec4baba0bd488a2f3b568d · Note
• https://github.com/openSUSE/open-build-service/commit/8595d06570ded81d8514c8c5a147b250541bf388 · Note
• https://suse.com/de-de/security/cve/CVE-2017-5188 · Note
• https://bugzilla.suse.com/show_bug.cgi?id=1029824 · Note