Back
CVE-2017-14804
package builds could use directory traversal to write outside of target area
Critical9.9EPSS 1.7%
- Published
- Updated
- Reserved
- Assigned by
- microfocus
Description
The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| microfocusCNA (assigner) | 3.0 | Critical9.9 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Modified | 3.0 | Medium5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
- EPSS (exploitation in 30 days)
- 1.7% · top 23% of all CVEs (4 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.9.
Weakness
- Insufficient pathname checking could use to bypass directory restrictions.
- CWE-22 (opens in a new tab)All about CWE-22 and its CVEs
- CWE-20 (opens in a new tab)All about CWE-20 and its CVEs
Affected products
What to do
Exploitation: Can be found in https://bugzilla.suse.com/show_bug.cgi?id=1069904
References (3)
- SUSE-SU-2017:3253 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
- SUSE-SU-2018:0065 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
- openSUSE-SU-2017:3259 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2017-14804)Record last updated .