Homepage

Directory Traversal The advisory has been revoked - it doesn't affect any version of package yum-utils  (opens in a new tab)

Threat Intelligence

EPSS
5.64% (93rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1804-YUMUTILS-614813
  • published10 Sept 2020
  • disclosed1 Aug 2018
Report a new vulnerability Found a mistake?

Introduced: 1 Aug 2018

CVE-2018-10897  (opens in a new tab)
CWE-22  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:18.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream yum-utils package and not the yum-utils package as distributed by Ubuntu.

A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.