CVE-2018-10897 : A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote

A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.

Published 2018-08-01 17:29:00

Updated 2023-02-13 04:51:38

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Directory traversal

Exploit prediction scoring system (EPSS) score for CVE-2018-10897

EPSS FAQ

0.69%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 78 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-10897

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9	Red Hat, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-10897

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: nvd@nist.gov (Secondary)

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Assigned by: secalert@redhat.com (Primary)

References for CVE-2018-10897

https://access.redhat.com/errata/RHSA-2018:2626

RHSA-2018:2626 - Security Advisory - Red Hat Customer Portal
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2284

RHSA-2018:2284 - Security Advisory - Red Hat Customer Portal
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10897

1600221 – (CVE-2018-10897) CVE-2018-10897 yum-utils: reposync: improper path validation may lead to directory traversal
Issue Tracking;Patch;Third Party Advisory
https://github.com/rpm-software-management/yum-utils/commit/7554c0133eb830a71dc01846037cc047d0acbc2c

reposync: refactor: sanitize remote_path usage · rpm-software-management/yum-utils@7554c01 · GitHub
Patch;Third Party Advisory
https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0

Security fixes in StruxureWare Data Center Expert v7.6.0 - User assistance for StruxureWare Data Center Expert 7.x - Help Center: Support for EcoStruxure IT, StruxureWare for Data Centers, and NetBotz
Third Party Advisory

CVEs referencing this url
https://github.com/rpm-software-management/yum-utils/commit/6a8de061f8fdc885e74ebe8c94625bf53643b71c

reposync: prevent path traversal. BZ 1552328 · rpm-software-management/yum-utils@6a8de06 · GitHub
Patch;Third Party Advisory
https://github.com/rpm-software-management/yum-utils/pull/43

reposync: check for .. in remote paths. BZ 1506205 by dmnks · Pull Request #43 · rpm-software-management/yum-utils · GitHub
Third Party Advisory
http://www.securitytracker.com/id/1041594

Red Hat Enterprise Virtualization Path Validation Flaw in 'reposync' Lets Remote Users Modify Files on the Target System - SecurityTracker
Third Party Advisory;VDB Entry
https://access.redhat.com/errata/RHSA-2018:2285

RHSA-2018:2285 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

Products affected by CVE-2018-10897

Redhat » Enterprise Linux Desktop » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Desktop » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Workstation » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Workstation » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Virtualization » Version: 4.0
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
Matching versions
RPM » Yum-utils
Versions up to, including, (<=) 1.1.31
cpe:2.3:a:rpm:yum-utils:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2018-10897

Exploit prediction scoring system (EPSS) score for CVE-2018-10897

CVSS scores for CVE-2018-10897

CWE ids for CVE-2018-10897

References for CVE-2018-10897

Products affected by CVE-2018-10897