CVE-2019-12449

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with GFILECOPYALLMETADATA) operations from admin:// to file:// URIs, because root privileges are unavailable.

References

Affected packages

Git / github.com/gnome/gvfs

Affected ranges

Type

GIT

Repo

https://github.com/gnome/gvfs

Events

Introduced

8baec79ab9cb2cb86095b071f3a40f7f6a751ef6

Last affected

769d0b47a88eff3ca14d34346491b2961e17ecd5

Database specific

{
    "versions": [
        {
            "introduced": "1.29.4"
        },
        {
            "last_affected": "1.41.2"
        }
    ]
}

Type: GIT
Repo: https://gitlab.gnome.org/GNOME/gvfs
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

409619412e11be146a31b9a99ed965925f1aabb8

Affected versions

1.*

1.10.0

1.11.0

1.11.1

1.11.2

1.11.3

1.11.4

1.11.5

1.12.0

1.12.1

1.13.0

1.13.1

1.13.2

1.13.3

1.13.4

1.13.5

1.13.6

1.13.7

1.13.8

1.13.9

1.14.0

1.15.0

1.15.1

1.15.2

1.15.3

1.15.4

1.16.0

1.17.0

1.17.1

1.17.2

1.17.3

1.17.90

1.18.0

1.18.1

1.18.2

1.19.1

1.19.2

1.19.3

1.19.4

1.19.5

1.19.90

1.20.0

1.21.1

1.21.2

1.21.3

1.21.4

1.21.90

1.21.92

1.22.0

1.23.1

1.23.2

1.23.3

1.23.4

1.23.90

1.23.92

1.24.0

1.25.1

1.25.2

1.25.3

1.25.4

1.25.4.1

1.25.90

1.25.91

1.25.92

1.26.0

1.26.1

1.26.1.1

1.26.2

1.27.3

1.27.4

1.27.90

1.27.91

1.27.92

1.28.0

1.28.1

1.29.1

1.29.2

1.29.3

1.29.4

1.29.90

1.29.91

1.29.92

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.30.0

1.31.1

1.31.2

1.31.3

1.31.4

1.31.90

1.31.91

1.31.92

1.32.0

1.33.1

1.33.3

1.33.90

1.33.91

1.33.92

1.34.0

1.35.1

1.35.2

1.35.3

1.35.4

1.35.90

1.35.91

1.35.92

1.36.0

1.37.1

1.37.2

1.37.4

1.37.90

1.37.91

1.38.0

1.39.1

1.39.3

1.39.4

1.39.90

1.39.91

1.39.92

1.4.0

1.40.0

1.41.1

1.41.2

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.7.0

1.7.1

1.7.2

1.7.3

1.9.0

1.9.1

1.9.2

1.9.3

1.9.4

1.9.5

Other

GVFS_0_0_1

GVFS_0_0_2

GVFS_0_1_0

GVFS_0_1_1

GVFS_0_1_10

GVFS_0_1_11

GVFS_0_1_2

GVFS_0_1_3

GVFS_0_1_4

GVFS_0_1_5

GVFS_0_1_6

GVFS_0_1_7

GVFS_0_1_8

GVFS_0_1_9

GVFS_0_2_0

GVFS_0_2_0_1

GVFS_0_2_1

GVFS_0_2_2

GVFS_0_2_4

GVFS_0_99_1

GVFS_0_99_2

GVFS_0_99_3

GVFS_0_99_4

GVFS_0_99_5

GVFS_0_99_6

GVFS_0_99_7

GVFS_1_1_1

GVFS_1_1_2

GVFS_1_1_3

GVFS_1_1_4

GVFS_1_1_5

GVFS_1_1_6

GVFS_1_1_7

GVFS_1_1_8

GVFS_1_2_1

GVFS_1_2_2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12449.json"

vanir_signatures

[
    {
        "source": "https://gitlab.gnome.org/GNOME/gvfs@409619412e11be146a31b9a99ed965925f1aabb8",
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2019-12449-42bca7d7",
        "digest": {
            "length": 1225.0,
            "function_hash": "231020120805253815594800467972206124585"
        },
        "signature_type": "Function",
        "target": {
            "file": "daemon/gvfsbackendadmin.c",
            "function": "g_vfs_backend_admin_class_init"
        }
    },
    {
        "source": "https://gitlab.gnome.org/GNOME/gvfs@409619412e11be146a31b9a99ed965925f1aabb8",
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2019-12449-e6d26694",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "188400266217883493317486595327510648447",
                "84370787118236718112280869999792270972",
                "235841846821089703407745877082633987750",
                "22225832117781730001295094493184023477",
                "10481938479286945038407544721119377788",
                "223840719794277329878536154385692187910",
                "85960072603906379813090528892411735538"
            ]
        },
        "signature_type": "Line",
        "target": {
            "file": "daemon/gvfsbackendadmin.c"
        }
    }
]

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "16.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18.10"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "19.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "29"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "30"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.1"
            }
        ]
    }
]