CVE-2017-14804

Name	CVE-2017-14804
Description	The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	887306

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
obs-build (PTS)	bullseye	20190710-1	fixed
	forky, sid, bookworm, trixie	20210120-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
obs-build	source	stretch	20160921-1+deb9u1
obs-build	source	(unstable)	20180302-1			887306

[jessie] - obs-build <no-dsa> (Minor issue)
https://bugzilla.suse.com/show_bug.cgi?id=1069904