CVE-2018-10897 Path traversal in yum-utils:
Attackers controlling a repository can overwrite critical system files via path traversal in reposync, potentially leading to system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-10897?
CVE-2018-10897 is a high-severity path traversal vulnerability in Redhat Enterprise Linux Desktop, published on 1 Aug 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.
Which versions are affected by CVE-2018-10897?
It affects 5 products.
Linux distribution packages (40)
yum-NetworkManager-dispatcher Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-aliases Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-auto-update-debug-info Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-changelog Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-fastestmirror Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-filter-data Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-fs-snapshot Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-keys Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-list-data Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-local Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-merge-conf Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-ovl Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-post-transaction-actions Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-priorities Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-protectbase Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-ps Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-remove-with-leaves Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-rpm-warm-cache Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-security Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-show-leaves Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-tmprepo Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-tsflags Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-upgrade-helper Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-verify Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-versionlock Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-updateonboot Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-utils Red Hat:enterprise_linux:6::client | All versions | 0:1.1.30-42.el6_10 |
yum-NetworkManager-dispatcher Red Hat:enterprise_linux:6::computenode | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-aliases Red Hat:enterprise_linux:6::computenode | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-auto-update-debug-info Red Hat:enterprise_linux:6::computenode | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-changelog Red Hat:enterprise_linux:6::computenode | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-fastestmirror Red Hat:enterprise_linux:6::computenode | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-filter-data Red Hat:enterprise_linux:6::computenode | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-fs-snapshot Red Hat:enterprise_linux:6::computenode | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-keys Red Hat:enterprise_linux:6::computenode | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-list-data Red Hat:enterprise_linux:6::computenode | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-local Red Hat:enterprise_linux:6::computenode | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-merge-conf Red Hat:enterprise_linux:6::computenode | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-ovl Red Hat:enterprise_linux:6::computenode | All versions | 0:1.1.30-42.el6_10 |
yum-plugin-post-transaction-actions Red Hat:enterprise_linux:6::computenode | All versions | 0:1.1.30-42.el6_10 |
Products include Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation, Redhat Virtualization, Rpm Yum-Utils.
How do I fix CVE-2018-10897?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-10897 being exploited?
There is no known exploitation of CVE-2018-10897 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux Desktop
Sources
Also known as GHSA-48q2-62w2-89cw, RHSA-2018:2284, RHSA-2018:2285, RHSA-2018:2626.