Directory Traversal Vulnerability in GNOME Software Products
CVE-2021-28650

5.5MEDIUM

Key Information:

Vendor

Gnome
Status
Gnome-autoar
Vendor
CVE Published:
17 March 2021

What is CVE-2021-28650?

A vulnerable component in GNOME's gnome-autoar library, specifically in autoar-extractor.c, exposes a risk of Directory Traversal during file extraction. This issue arises when the extraction process does not properly verify whether a file's parent directory is a symbolic link, particularly under certain complex conditions. This vulnerability is a result of an incomplete resolution of a previous security flaw, emphasizing the importance of comprehensive checks during file operations in GNOME software such as GNOME Shell and Nautilus.

References

https://gitlab.gnome.org/GNOME/gnome-autoar/-/commit/8109...
x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisoryx_refsource_FEDORA
https://security.gentoo.org/glsa/202105-10
vendor-advisoryx_refsource_GENTOO

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.