Medium severity · published Mar 1, 2018
CVE-2017-14804
The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing…
5.3
CVSS
1.7%
EPSS
No
On KEV
Description
The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Leap · Opensuse
42.2; 42.3 · source: NVD
LE
Linux Enterprise Software Development Kit · Suse
11; 12; 12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-14804
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-14804
lists.opensuse.org
https://lists.opensuse.org/opensuse-security-announce/2017-12/msg00024.html
lists.opensuse.org
https://lists.opensuse.org/opensuse-security-announce/2017-12/msg00025.html
lists.opensuse.org
https://lists.opensuse.org/opensuse-security-announce/2018-01/msg00030.html
More from Leap
9.8
CVE-2020-16846
SaltStack Salt Shell Injection Vulnerability
9.8
CVE-2020-12641
Roundcube Webmail Remote Code Execution Vulnerability
9.8
CVE-2020-11651
SaltStack Salt Authentication Bypass Vulnerability
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
9.8
CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability