CVE-2017-14804: opensuse leap Path Traversal
CVSS: 9.9v3.0CriticalModified
AliasesSUSE-SU-2019:0387-1UBUNTU-CVE-2017-14804DEBIAN-CVE-2017-14804openSUSE-SU-2019:0232-1
Published 01-03-2018Last modified 16-09-2024
Vulnerability summary
CVE-2017-14804 is a critical (CVSS 9.9) Path Traversal vulnerability in opensuse leap. EPSS estimates a 1.71% chance of exploitation in the next 30 days, higher than 77.1% of scored vulnerabilities.
CVSS score
9.9/10
010
Critical · v3.0 (CVE.org)EPSS score
1.71%
0%100%
Low · -0.19 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 01-03-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.
CVSS metrics
5 scores · 4 sources · 2 versionsCritical 9.9Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSources4 sources · 5.3–9.9
- NVDNIST5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
1.71%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
-0.19 pp
From 1.90% on 21-09-2026
21-09-202621-10-2026
EPSS score1.71%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Suse3 products
- build&distro=SUSE Linux Enterprise Module for Development Tools 15< 20190128-3.3.2
- build≥ unspecified, ≤ 20171128
- linux_enterprise_software_development_kit11:sp4 | 12:sp2 | 12:sp3
Opensuse2 products
- leapEOL42.2 | 42.3
- build&distro=openSUSE Leap 15.0< 20190128-lp150.2.3.1
Debian1 product
- obs-build< 20180302-1
Ubuntu1 product
- obs-buildAll versions (No fix recorded)
4 vendors · 7 products
References
12 linksShow all 12 references
- lists.opensuse.org/archives/…Advisory