package builds could use directory traversal to write outside of target area
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.9epss 1.7%
exploitation probability
1.7%top 24% of all CVEs
observed exploitation
nono source reports it
In short
A flaw in the build package allowed untrusted builds to write files outside their intended directory during extraction, potentially compromising the entire system. This happened because the package didn't validate directory names properly.
Technical detail
The build package prior to version 20171128 failed to sanitize directory names during extraction of build artifacts, enabling a directory traversal attack (CWE-22). An untrusted build could exploit this to write files outside the buildroot, escaping containment and potentially achieving arbitrary file write on the host system.
Summary generated and translated by AI from the official description.
The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
SUSE · build