Link Following Affecting glib2 package, versions <0:2.56.1-9.amzn2.0.7
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-AMZN2-GLIB2-6371137
- published 5 Mar 2024
- disclosed 11 Mar 2021
Introduced: 11 Mar 2021
CVE-2021-28153 Open this link in a new tabHow to fix?
Upgrade Amazon-Linux:2
glib2
to version 0:2.56.1-9.amzn2.0.7 or higher.
This issue was patched in ALAS2-2024-2487
.
NVD Description
Note: Versions mentioned in the description apply only to the upstream glib2
package and not the glib2
package as distributed by Amazon-Linux
.
See How to fix?
for Amazon-Linux:2
relevant fixed versions and status.
An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)
References
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28153
- https://gitlab.gnome.org/GNOME/glib/-/issues/2325
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6RXTD5HCP2K4AAUSWWZTBKQNHRCTAEOF/
- https://security.netapp.com/advisory/ntap-20210416-0003/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICUTQPHZNZWX2DZR46QFLQZRHVMHIILJ/
- https://security.gentoo.org/glsa/202107-13
- https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RXTD5HCP2K4AAUSWWZTBKQNHRCTAEOF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICUTQPHZNZWX2DZR46QFLQZRHVMHIILJ/