CVE-2021-28650: Medium severity gnome autoar vulnerability
Published Mar 17, 2021
·Updated
autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-36241.
Affected Software
2 affected components
Gnome gnome-autoar<0.3.1
Fedoraproject Fedora=34
Remediation
Event History
Mar 17, 2021
CVE Published
via MITRE·05:51 AM
Data Sourced
via MITRE·05:51 AM
Description
Data Sourced
via Red Hat·01:30 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-28650.
2
What is the severity of CVE-2021-28650?
The severity of CVE-2021-28650 is medium with a CVSS score of 5.5.
3
Which software is affected by CVE-2021-28650?
GNOME gnome-autoar before version 0.3.1 and Fedora 34 are affected by CVE-2021-28650.
4
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is CWE-59.
5
How can the vulnerability be exploited?
The vulnerability can be exploited by performing a directory traversal during extraction in certain complex situations.