Medium · 5.0 CVE-2017-5188 EUVD-2017-14297GHSA-m6v2-2pmh-qf44

OBS worker VM escape via relative symbolic links

Published Mar 1, 2018 · Updated Sep 16, 2024 · Assigned by microfocus

Vendor: openSUSE Product: open build service Package: open-build-service Package: open-build-service Ecosystem: Debian Ecosystem: Ubuntu

Description

The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information.

Affected products

Vendor	Product	Affected	Fixed
openSUSE	open build service	unspecified – < 20170320	20170320

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 12	open-build-service	2.7.4-3	—

Ubuntu