CVE-2017-5188
published 2018-03-01CVE-2017-5188: The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during…
PriorityP336high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EPSS
1.17%
64.1th percentile
The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | open-build-service | < open-build-service 2.7.4-3 (bookworm) | open-build-service 2.7.4-3 (bookworm) |
| opensuse | open_build_service | <= 2.7.3 | — |
| opensuse | open_build_service | >= unspecified < 20170320 | 20170320 |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_debian5.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2017-5188: open-build-service - The bs_worker code in open build service before 20170320 followed relative symli...
vendor_debian·2017·CVSS 5.0
CVE-2017-5188 [MEDIUM] CVE-2017-5188: open-build-service - The bs_worker code in open build service before 20170320 followed relative symli...
The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information.
Scope: local
bookworm: resolved (fixed in 2.7.4-3)
sid: resolved (fixed in 2.7.4-3)
GHSA
GHSA-m6v2-2pmh-qf44: The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory
ghsa_unreviewed·2022-05-13
CVE-2017-5188 [HIGH] CWE-200 GHSA-m6v2-2pmh-qf44: The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory
The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information.
OSV
CVE-2017-5188: The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory
osv·2018-03-01·CVSS 7.5
CVE-2017-5188 [HIGH] CVE-2017-5188: The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory
The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.suse.com/show_bug.cgi?id=1029824https://github.com/openSUSE/open-build-service/commit/ba27c91351878bc297ec4baba0bd488a2f3b568dhttps://www.suse.com/de-de/security/cve/CVE-2017-5188/https://bugzilla.suse.com/show_bug.cgi?id=1029824https://github.com/openSUSE/open-build-service/commit/ba27c91351878bc297ec4baba0bd488a2f3b568dhttps://www.suse.com/de-de/security/cve/CVE-2017-5188/
2018-03-01
Published