CVE-2017-14804: critical vulnerability in SUSE build
package builds could use directory traversal to write outside of target area
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in the build package allowed untrusted builds to write files outside their intended directory during extraction, potentially compromising the entire system. This happened because the package didn't validate directory names properly.
The build package prior to version 20171128 failed to sanitize directory names during extraction of build artifacts, enabling a directory traversal attack (CWE-22). An untrusted build could exploit this to write files outside the buildroot, escaping containment and potentially achieving arbitrary file write on the host system.