CVE-2017-14730

Name: CVE-2017-14730
Creator: NVD / NIST
Published: 2017-09-25T17:29:00.787+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.35%

Last modified Jun 17, 2026

CVE-2017-14730 is a vulnerability of currently unknown severity. The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1 has "chown -R" calls for user-writable directory trees, which allows local users to gain privileges by leveraging access to a $LS_USER account for creation of a hard link.. EPSS estimates a 0.35% chance of exploitation in the next 30 days.

Description

The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1 has "chown -R" calls for user-writable directory trees, which allows local users to gain privileges by leveraging access to a $LS_USER account for creation of a hard link.

Metrics

EPSS Probability

0.35%

26.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-732

Affected Software

Vendor	Product	Versions
Elasticsearch	Logstash	5.0.0
Elasticsearch	Logstash	5.0.1
Elasticsearch	Logstash	5.0.2
Elasticsearch	Logstash	5.1.1
Elasticsearch	Logstash	5.1.2
Elasticsearch	Logstash	5.2.0
Elasticsearch	Logstash	5.2.1
Elasticsearch	Logstash	5.3.0
Elasticsearch	Logstash	5.3.1
Elasticsearch	Logstash	5.3.2
Elasticsearch	Logstash	5.4.1
Elasticsearch	Logstash	5.4.2
Elasticsearch	Logstash	5.4.3
Elasticsearch	Logstash	5.5.0
Elasticsearch	Logstash	5.5.1
Elasticsearch	Logstash	5.5.2
Elasticsearch	Logstash	5.6.0

References

https://bugs.gentoo.org/628558Third Party Advisory
https://github.com/gentoo/gentoo/pull/5665Third Party Advisory
https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=18f97c851c209f291b31ae7a902719f1c17c79faThird Party Advisory
https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bbd6cb398c1740c68e9b1b78340c887c58c1fbdaThird Party Advisory
https://bugs.gentoo.org/628558Third Party Advisory
https://github.com/gentoo/gentoo/pull/5665Third Party Advisory
https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=18f97c851c209f291b31ae7a902719f1c17c79faThird Party Advisory
https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bbd6cb398c1740c68e9b1b78340c887c58c1fbdaThird Party Advisory

Timeline

Published: Sep 25, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-14730?

How severe is CVE-2017-14730?

Severity scoring for CVE-2017-14730 is pending analysis. The EPSS model estimates a 0.35% probability of exploitation in the next 30 days.

How do I fix CVE-2017-14730?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-14730?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST