CVE-2017-5188 - CVE House
Back to Database
Status published Medium CVE-2017-5188

OBS worker VM escape via relative symbolic links

Vulnerability Description

The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-5188

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Fabian Vogt of SUSE

References

More from openSUSE

View All →
CVE-2025-53881
SUSE-specific logrotate configuration allows escalation from mail user/group to root
Medium 6.9
CVE-2025-46810
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging...
High 8.5
CVE-2024-49506
Fixed temporary file path in aeon-checks allows fixing of disk encryption key
High 7.3
CVE-2024-49505
XSS vulnerability found in OpenSuse MirrorCache
Medium 5.3
CVE-2023-32184
A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome...
High 7.8

Affected Vendor

Affected Software

open build service
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 1st, 2018
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.