Lucene search

K
gitlabHttps://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-F5BF307B68975767D28FF3F1745F990C
HistoryMar 11, 2021 - 12:00 a.m.

Improper Link Resolution Before File Access

2021-03-1100:00:00
https://gitlab.com/gitlab-org/security-products/gemnasium-db
gitlab.com
23
g_file_replace
g_file_create_replace_destination
dangling symlink
security relevance
attacker-controlled

EPSS

0.013

Percentile

86.0%

When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled.