CVE-2021-28153 Path traversal in n/a

What is CVE-2021-28153?

CVE-2021-28153 is a medium-severity path traversal vulnerability in Debian Debian Linux, published on 11 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)

Weakness: CWE-59

Which versions are affected by CVE-2021-28153?

It affects 4 products.

Products include Broadcom Brocade Fabric Operating System Firmware, Debian Debian Linux, Fedoraproject Fedora, Gnome Glib.

How do I fix CVE-2021-28153?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-28153 being exploited?

There is no known exploitation of CVE-2021-28153 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2023-27534 Path traversal in https://github.com/curl/curl High 8.8
• CVE-2021-4197 Privilege escalation in kernel High 7.8
• CVE-2023-27538 Auth bypass in https://github.com/curl/curl High 7.7
• CVE-2021-27218 Integer overflow in n/a High 7.5
• CVE-2021-27219 Integer overflow in n/a High 7.5

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2021-28153, ALSA-2022:8418, AZL-6439, CLSA-2021-1623075923, CLSA-2021-1634922588, DEBIAN-CVE-2021-28153 and 12 more.