package builds could use directory traversal to write outside of target area

published 2018-03-01 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-6293

cvss: 9.9; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.7%; EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits: 0; none known

The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.

Patch / fix

distros 3

debian suse opensuse

obs-build Debian 14, Debian 13, Debian 12 20180302-1

debian advisories DEBIAN-CVE-2017-14804

build SLE Module for Development Tools 15 20190128-3.3.2
osc SLE Software Development Kit 11 SP4 0.162.1-7.4.1
build SLE Software Development Kit 11 SP4 20171128-8.3.3
osc SLE Software Development Kit 12 SP3, SLE Software Development Kit 12 SP2 0.162.0-15.3.1
build SLE Software Development Kit 12 SP3, SLE Software Development Kit 12 SP2 20171128-9.3.2
obs-service-source_validator SLE Software Development Kit 12 SP3, SLE Software Development Kit 12 SP2 0.7-9.3.1

suse advisories SUSE-SU-2019:0387-1 SUSE-SU-2018:0065-1 SUSE-SU-2017:3253-1

build openSUSE Leap 15.0 20190128-lp150.2.3.1

opensuse advisories openSUSE-SU-2019:0232-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-14804 updated 2025-11-21 cvss 7.8

obs-build: Exploit extractbuild to write to files in the host system

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.71% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.0	9.9	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD	3.0	5.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

SUSE build

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-20 Improper Input Validation

References

lists.opensuse.org /opensuse-security-announce/2017-12/msg00024.html
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2018-01/msg00030.html
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2017-12/msg00025.html
vendor-advisory

Sources

CVE List CVE-2017-14804
NVD CVE-2017-14804

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary