CVE-2017-18018

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

For this vulnerability the fix was an update to the documentation. For more details please visit: https://www.openwall.com/lists/oss-security/2018/01/04/3 http://michael.orlitzky.com/cves/cve-2017-18018.xhtml

Red Hat Enterprise Linux 8 ships already updated version of the coreutils package (version 8.30).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.