title: package builds could use directory traversal to write outside of target area
description: The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.
problem types: Insufficient pathname checking could use to bypass directory restrictions.
affected:
{
product: build
vendor: SUSE
versions:
lessThanOrEqual: 20171128, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.0
]
exploits: Can be found in https://bugzilla.suse.com/show_bug.cgi?id=1069904