Описание
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies finish-args
last in the build. At this point the build directory will have the full access that is specified in the manifest, so running flatpak build
against it will gain those permissions. Normally this will not be done, so this is not problem. However, if --mirror-screenshots-url
is specified, then flatpak-builder will launch flatpak build --nofilesystem=host appstream-utils mirror-screenshots
after finalization, which can lead to issues even with the --nofilesystem=host
protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the appstream-util
binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of --nofilesystem=home
and --nofilesystem=host
.
A path traversal vulnerability was found in Flatpak. This happens when flatpak-builder applies finish-args
last in the build. At this point the build directory will have the full access that is specified in the manifest, so running flatpak build
against it will gain those permissions.
Затронутые пакеты
Платформа | Пакет | Состояние | Рекомендация | Релиз |
---|---|---|---|---|
Red Hat Enterprise Linux 7 | flatpak | Not affected | ||
Red Hat Enterprise Linux 9 | flatpak | Not affected | ||
Red Hat Enterprise Linux 8 | flatpak-builder | Fixed | RHSA-2022:7458 | 08.11.2022 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.7 High
CVSS3
Связанные уязвимости
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour o...
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `
Flatpak is a Linux application sandboxing and distribution framework. ...
ELSA-2022-7458: flatpak-builder security and bug fix update (MODERATE)
EPSS
7.7 High
CVSS3