{"id":"CVE-2018-10897","details":"A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.","modified":"2026-10-20T10:50:16.868548458Z","published":"2018-08-01T17:29:00.457Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:rpm:yum-utils:*:*:*:*:*:*:*:*"],"extracted_events":[{"range":[{"last_affected":"1.1.31"}],"source":"CPE_RANGE"}],"vendor_product":"rpm:yum-utils"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"range":[{"introduced":"6.0"},{"last_affected":"6.0"},{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING"}],"vendor_product":"redhat:enterprise_linux_desktop"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"range":[{"introduced":"6.0"},{"last_affected":"6.0"},{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING"}],"vendor_product":"redhat:enterprise_linux_server"},{"vendor_product":"redhat:enterprise_linux_workstation","cpes":["cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"source":"CPE_STRING","range":[{"introduced":"6.0"},{"last_affected":"6.0"},{"introduced":"7.0"},{"last_affected":"7.0"}]}]},{"cpes":["cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*"],"extracted_events":[{"source":"CPE_STRING","range":[{"introduced":"4.0"},{"last_affected":"4.0"}]}],"vendor_product":"redhat:virtualization"},{"extracted_events":[{"range":[{"last_affected":"1.1.31"}],"source":"DESCRIPTION"}]}]},"references":[{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1041594"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2284"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2285"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2626"},{"type":"ADVISORY","url":"https://github.com/rpm-software-management/yum-utils/pull/43"},{"type":"ADVISORY","url":"https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10897"},{"type":"FIX","url":"https://github.com/rpm-software-management/yum-utils/commit/6a8de061f8fdc885e74ebe8c94625bf53643b71c"},{"type":"FIX","url":"https://github.com/rpm-software-management/yum-utils/commit/7554c0133eb830a71dc01846037cc047d0acbc2c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rpm-software-management/yum-utils","events":[{"introduced":"0"},{"fixed":"6a8de061f8fdc885e74ebe8c94625bf53643b71c"},{"fixed":"7554c0133eb830a71dc01846037cc047d0acbc2c"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"6a8de061f8fdc885e74ebe8c94625bf53643b71c"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"7554c0133eb830a71dc01846037cc047d0acbc2c"}],"source":"REFERENCES_COMMIT"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-10897.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}