Bug 1719141 (CVE-2019-12450)
| Summary: | CVE-2019-12450 glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | caillon+fedoraproject, erack, erik-fedora, fedora, fidencio, gecko-bugs-nobody, gnome-sig, jhorak, john.j5live, klember, marcandre.lureau, mclasen, rh-spice-bugs, rhughes, rjones, rstrode, sandmann, stransky, tbrunell, tiagomatos, walters |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-11-06 00:52:49 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1719142, 1719268, 1719270, 1722099, 1722101, 1722280 | ||
| Bug Blocks: | 1719146 | ||
|
Description
Marian Rehak
2019-06-11 07:16:43 UTC
Created glib2 tracking bugs for this issue: Affects: fedora-all [bug 1719142] Created mingw-glib2 tracking bugs for this issue: Affects: fedora-all [bug 1719268] Created mingw-glib2 tracking bugs for this issue: Affects: epel-7 [bug 1719270] Statement: This issue affects the versions of glib2 as shipped with Red Hat Enterprise Linux 6, 7 and 8 . Red Hat Product Security has rated this issue as having a security impact of Moderate. Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/. There's a flaw when copying a file using g_file_copy() glib's API function where gio library firstly create the destination file with default permissions before the copy ends. The bug is located at file_copy_fallback() which when called under certain circumstances creates new files using default permissions instead the same of origin file, the right permissions are set once the data copy ends. While the data copy is ongoing the file may be improper accessible by users which doesn't have permissions to read or write to it, compromising data confidentiality and integrity. This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:3530 https://access.redhat.com/errata/RHSA-2019:3530 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-12450 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:3978 https://access.redhat.com/errata/RHSA-2020:3978 |