Critical File Permission Vulnerability in GLib Package
Summary
ALPINE-CVE-2019-12450: file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Affects glib versions < 2.60.4-r0. Fixed in 2.60.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GLib is a low-level core library that forms the basis for projects such as GTK and GNOME. It provides data structures, utility functions, and object-oriented programming features for C. The library is widely used in various applications, making it crucial for developers to ensure its security. The vulnerability in question affects versions of GLib prior to 2.60.4, where improper file permission handling during copy operations can lead to unauthorized access to sensitive files.
Vulnerability Detail
The vulnerability, identified as CVE-2019-12450, originates from the file_copy_fallback function in gio/gfile.c within GLib versions 2.15.0 to 2.61.1. It fails to properly restrict file permissions while a copy operation is in progress, leading to the application using default permissions instead. This can result in sensitive files being exposed to unauthorized users, potentially allowing them to read or modify critical data. The CVSS score for this vulnerability is 9.8, indicating a high severity level that necessitates immediate attention.
How To Fix
Minimum fixed version
2.60.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade glibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to sensitive files manually during copy operations by adjusting file permissions using the chmod command. For example, you can run 'chmod 600 <filename>' to limit access to the file owner only.
Conclusion
The CVE-2019-12450 vulnerability in the GLib package poses a significant risk due to improper file permission handling during copy operations. It is crucial to update to the patched version to mitigate this risk. For those unable to update immediately, temporary workarounds can help secure sensitive files.
See every vulnerability recorded for glib →
FAQ
CVE-2019-12450 is a vulnerability in the GLib package that allows improper file permission handling during copy operations, potentially exposing sensitive files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2019-12450 is 9.8, indicating a critical level of severity.
If an immediate update is not possible, consider implementing manual file permission restrictions as a temporary workaround.
More information about GLib can be found on its official documentation page or the GNOME project website.
References
Related vulnerabilities
Recent vulnerabilities recorded for glib.
