CVE catalog

CVE-2017-14804

obs-build: CVE-2017-14804

[CVE catalog]

Severity
Critical · CVSS 9.9CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.71% · Oct 25, 2026

The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianobs-buildsid20210120-4fixed
Debianobs-buildforky20210120-4fixed
Debianobs-buildtrixie20210120-4fixed
Debianobs-buildbookworm20210120-4fixed
Opensusebuildleap 15.020190128-lp150.2.3.1fixed
Susebuildlinux enterprise module for development tools 1520190128-3.3.2fixed
Susebuildlinux enterprise software development kit 11 sp420171128-8.3.3fixed
Suseosclinux enterprise software development kit 11 sp40.162.1-7.4.1fixed
Susebuildlinux enterprise software development kit 12 sp220171128-9.3.2fixed
Suseobs-service-source_validatorlinux enterprise software development kit 12 sp20.7-9.3.1fixed
Suseosclinux enterprise software development kit 12 sp20.162.0-15.3.1fixed
Susebuildlinux enterprise software development kit 12 sp320171128-9.3.2fixed
Suseobs-service-source_validatorlinux enterprise software development kit 12 sp30.7-9.3.1fixed
Suseosclinux enterprise software development kit 12 sp30.162.0-15.3.1fixed
Ubuntuobs-build16.0420141024-1vulnerable
Ubuntuobs-build16.0420141024-1.1vulnerable
Ubuntuobs-build18.0420170201-3vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianobs-buildsourcesid20180302-1not yet assignedNot reported[887306]
Debianobs-buildsourceforky20180302-1not yet assignedNot reported[887306]
Debianobs-buildsourcetrixie20180302-1not yet assignedNot reported[887306]
Debianobs-buildsourcebookworm20180302-1not yet assignedNot reported[887306]
Opensusebuildrpmleap 15.020190128-lp150.2.3.1Not reportedOPENSUSE-SU-2019:0232-1Not reported
Susebuildrpmlinux enterprise module for development tools 1520190128-3.3.2Not reportedSUSE-SU-2019:0387-1Not reported
Susebuildrpmlinux enterprise software development kit 11 sp420171128-8.3.3Not reportedSUSE-SU-2018:0065-1Not reported
Suseoscrpmlinux enterprise software development kit 11 sp40.162.1-7.4.1Not reportedSUSE-SU-2018:0065-1Not reported
Susebuildrpmlinux enterprise software development kit 12 sp220171128-9.3.2Not reportedSUSE-SU-2017:3253-1Not reported
Suseobs-service-source_validatorrpmlinux enterprise software development kit 12 sp20.7-9.3.1Not reportedSUSE-SU-2017:3253-1Not reported
Suseoscrpmlinux enterprise software development kit 12 sp20.162.0-15.3.1Not reportedSUSE-SU-2017:3253-1Not reported
Susebuildrpmlinux enterprise software development kit 12 sp320171128-9.3.2Not reportedSUSE-SU-2017:3253-1Not reported
Suseobs-service-source_validatorrpmlinux enterprise software development kit 12 sp30.7-9.3.1Not reportedSUSE-SU-2017:3253-1Not reported
Suseoscrpmlinux enterprise software development kit 12 sp30.162.0-15.3.1Not reportedSUSE-SU-2017:3253-1Not reported

[Debian bug #887306]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [obs-build]Fixed
    Details (2)

    • 20210120-4 · all · bookworm

      Fixed · Fixed: 20180302-1

      dsa · obs-build · debian · bookworm; dsa · obs-build · debian · 12

    • 20210120-4 · all · bookworm

      Fixed · Fixed: 20180302-1

      dsa · obs-build · debian · bookworm; dsa · obs-build · debian · 12

[Debian 13 (Trixie)]

  • [obs-build]Fixed
    Details (2)

    • 20210120-4 · all · trixie

      Fixed · Fixed: 20180302-1

      dsa · obs-build · debian · 13

    • 20210120-4 · all · trixie

      Fixed · Fixed: 20180302-1

      dsa · obs-build · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]