CVE-2021-28153: Improper Link Resolution Before File Access

March 11, 2021 (updated November 9, 2023)

When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled.

References

gitlab.gnome.org/GNOME/glib/-/issues/2325
nvd.nist.gov/vuln/detail/CVE-2021-28153

Code Behaviors & Features

Detect and mitigate CVE-2021-28153 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →