Skip to content
Fencer Vulns
high 8.8

CVE-2018-10897 json

A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configu…

published 2018-08-01 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-2956

cvss
8.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
5.6%
EPSS 5.6% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known

Summary

A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.

Patch / fix

  • imgbased RHEL 7 1.0.24-1.el7ev
  • python-imgbased RHEL 7 1.0.24-1.el7ev
  • redhat-virtualization-host RHEL 7 4.2-20180828.2.el7_5
  • redhat-release-virtualization-host RHEL 7 4.2-6.0.el7
  • redhat-virtualization-host-image-update RHEL 7 4.2-20180828.2.el7_5
  • redhat-virtualization-host-image-update-placeholder RHEL 7 4.2-6.0.el7
  • yum-utils RHEL 6 1.1.30-42.el6_10
  • yum-plugin-ps RHEL 6 1.1.30-42.el6_10

red hat advisories RHSA-2018:2626RHSA-2018:2284RHSA-2018:2285

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-10897 updated cvss 8.8

yum-utils: reposync: improper path validation may lead to directory traversal

  • Red Hat Enterprise Linux 5 yum-utils
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux Client (v. 7) yum-utils 1.1.31-46.el7_5, yum-plugin-ovl 1.1.31-46.el7_5, yum-plugin-verify 1.1.31-46.el7_5, yum-plugin-aliases 1.1.31-46.el7_5, yum-plugin-tmprepo 1.1.31-46.el7_5, yum-plugin-changelog 1.1.31-46.el7_5, +1 more Red Hat Enterprise Linux Client Optional (v. 7) yum-plugin-ps 1.1.31-46.el7_5, yum-plugin-copr 1.1.31-46.el7_5, yum-plugin-keys 1.1.31-46.el7_5, yum-plugin-local 1.1.31-46.el7_5, yum-updateonboot 1.1.31-46.el7_5, yum-plugin-tsflags 1.1.31-46.el7_5, +15 more Red Hat Enterprise Linux ComputeNode (v. 7) yum-utils 1.1.31-46.el7_5, yum-plugin-ovl 1.1.31-46.el7_5, yum-plugin-verify 1.1.31-46.el7_5, yum-plugin-aliases 1.1.31-46.el7_5, yum-plugin-tmprepo 1.1.31-46.el7_5, yum-plugin-changelog 1.1.31-46.el7_5, +1 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) yum-plugin-ps 1.1.31-46.el7_5, yum-plugin-copr 1.1.31-46.el7_5, yum-plugin-keys 1.1.31-46.el7_5, yum-plugin-local 1.1.31-46.el7_5, yum-updateonboot 1.1.31-46.el7_5, yum-plugin-tsflags 1.1.31-46.el7_5, +15 more
    fixed: vendor fix RHSA-2018:2285
  • Red Hat Enterprise Linux Desktop (v. 6) yum-utils 1.1.30-42.el6_10, yum-plugin-ovl 1.1.30-42.el6_10, yum-plugin-verify 1.1.30-42.el6_10, yum-plugin-aliases 1.1.30-42.el6_10, yum-plugin-tmprepo 1.1.30-42.el6_10, yum-plugin-security 1.1.30-42.el6_10, +2 more Red Hat Enterprise Linux Desktop Optional (v. 6) yum-plugin-ps 1.1.30-42.el6_10, yum-plugin-keys 1.1.30-42.el6_10, yum-plugin-local 1.1.30-42.el6_10, yum-updateonboot 1.1.30-42.el6_10, yum-plugin-tsflags 1.1.30-42.el6_10, yum-plugin-list-data 1.1.30-42.el6_10, +13 more
    fixed: vendor fix RHSA-2018:2284
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) yum-utils 1.1.31-46.el7_5, yum-plugin-ovl 1.1.31-46.el7_5, yum-plugin-verify 1.1.31-46.el7_5, yum-plugin-aliases 1.1.31-46.el7_5, yum-plugin-tmprepo 1.1.31-46.el7_5, yum-plugin-changelog 1.1.31-46.el7_5, +1 more Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) yum-plugin-ps 1.1.31-46.el7_5, yum-plugin-copr 1.1.31-46.el7_5, yum-plugin-keys 1.1.31-46.el7_5, yum-plugin-local 1.1.31-46.el7_5, yum-updateonboot 1.1.31-46.el7_5, yum-plugin-tsflags 1.1.31-46.el7_5, +15 more
    fixed: vendor fix RHSA-2018:2285
  • Red Hat Enterprise Linux HPC Node (v. 6) yum-utils 1.1.30-42.el6_10, yum-plugin-ovl 1.1.30-42.el6_10, yum-plugin-verify 1.1.30-42.el6_10, yum-plugin-aliases 1.1.30-42.el6_10, yum-plugin-tmprepo 1.1.30-42.el6_10, yum-plugin-security 1.1.30-42.el6_10, +2 more Red Hat Enterprise Linux HPC Node Optional (v. 6) yum-plugin-ps 1.1.30-42.el6_10, yum-plugin-keys 1.1.30-42.el6_10, yum-plugin-local 1.1.30-42.el6_10, yum-updateonboot 1.1.30-42.el6_10, yum-plugin-tsflags 1.1.30-42.el6_10, yum-plugin-list-data 1.1.30-42.el6_10, +13 more Red Hat Enterprise Linux Server (v. 6) yum-utils 1.1.30-42.el6_10, yum-plugin-ovl 1.1.30-42.el6_10, yum-plugin-verify 1.1.30-42.el6_10, yum-plugin-aliases 1.1.30-42.el6_10, yum-plugin-tmprepo 1.1.30-42.el6_10, yum-plugin-security 1.1.30-42.el6_10, +2 more
    fixed: vendor fix RHSA-2018:2284
  • Red Hat Enterprise Linux Server (v. 7) yum-utils 1.1.31-46.el7_5, yum-plugin-ovl 1.1.31-46.el7_5, yum-plugin-verify 1.1.31-46.el7_5, yum-plugin-aliases 1.1.31-46.el7_5, yum-plugin-tmprepo 1.1.31-46.el7_5, yum-plugin-changelog 1.1.31-46.el7_5, +1 more
    fixed: vendor fix RHSA-2018:2285
  • Red Hat Enterprise Linux Server Optional (v. 6) yum-plugin-ps 1.1.30-42.el6_10, yum-plugin-keys 1.1.30-42.el6_10, yum-plugin-local 1.1.30-42.el6_10, yum-updateonboot 1.1.30-42.el6_10, yum-plugin-tsflags 1.1.30-42.el6_10, yum-plugin-list-data 1.1.30-42.el6_10, +13 more
    fixed: vendor fix RHSA-2018:2284
  • Red Hat Enterprise Linux Server Optional (v. 7) yum-plugin-ps 1.1.31-46.el7_5, yum-plugin-copr 1.1.31-46.el7_5, yum-plugin-keys 1.1.31-46.el7_5, yum-plugin-local 1.1.31-46.el7_5, yum-updateonboot 1.1.31-46.el7_5, yum-plugin-tsflags 1.1.31-46.el7_5, +15 more
    fixed: vendor fix RHSA-2018:2285
show 6 more
  • Red Hat Enterprise Linux Workstation (v. 6) yum-utils 1.1.30-42.el6_10, yum-plugin-ovl 1.1.30-42.el6_10, yum-plugin-verify 1.1.30-42.el6_10, yum-plugin-aliases 1.1.30-42.el6_10, yum-plugin-tmprepo 1.1.30-42.el6_10, yum-plugin-security 1.1.30-42.el6_10, +2 more
    fixed: vendor fix RHSA-2018:2284
  • Red Hat Enterprise Linux Workstation (v. 7) yum-utils 1.1.31-46.el7_5, yum-plugin-ovl 1.1.31-46.el7_5, yum-plugin-verify 1.1.31-46.el7_5, yum-plugin-aliases 1.1.31-46.el7_5, yum-plugin-tmprepo 1.1.31-46.el7_5, yum-plugin-changelog 1.1.31-46.el7_5, +1 more
    fixed: vendor fix RHSA-2018:2285
  • Red Hat Enterprise Linux Workstation Optional (v. 6) yum-plugin-ps 1.1.30-42.el6_10, yum-plugin-keys 1.1.30-42.el6_10, yum-plugin-local 1.1.30-42.el6_10, yum-updateonboot 1.1.30-42.el6_10, yum-plugin-tsflags 1.1.30-42.el6_10, yum-plugin-list-data 1.1.30-42.el6_10, +13 more
    fixed: vendor fix RHSA-2018:2284
  • Red Hat Enterprise Linux Workstation Optional (v. 7) yum-plugin-ps 1.1.31-46.el7_5, yum-plugin-copr 1.1.31-46.el7_5, yum-plugin-keys 1.1.31-46.el7_5, yum-plugin-local 1.1.31-46.el7_5, yum-updateonboot 1.1.31-46.el7_5, yum-plugin-tsflags 1.1.31-46.el7_5, +15 more
    fixed: vendor fix RHSA-2018:2285
  • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host 4.2-20180828.2.el7_5, redhat-virtualization-host-image-update 4.2-20180828.2.el7_5 Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) imgbased 1.0.24-1.el7ev, python-imgbased 1.0.24-1.el7ev, redhat-release-virtualization-host 4.2-6.0.el7, redhat-virtualization-host-image-update-placeholder 4.2-6.0.el7
    fixed: vendor fix RHSA-2018:2626
  • Red Hat Enterprise Linux 8 yum-utils, dnf-plugins-core, python3-dnf-plugins-core, python3-dnf-plugin-versionlock, python3-dnf-plugin-post-transaction-actions
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

5.64% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • The RPM Project yum-utils:

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.