Moderate: flatpak security, bug fix, and enhancement update
Summary
ALSA-2023:6518: Moderate: flatpak security, bug fix, and enhancement update. Affects flatpak versions < 1.12.8-1.el9. Fixed in 1.12.8-1.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. It provides a secure and isolated environment for running applications, ensuring that they cannot access sensitive system resources or interfere with other applications. Flatpak is widely used in the Linux ecosystem to package and distribute desktop applications.
Vulnerability Detail
This update addresses two security vulnerabilities in the flatpak package:
-
CVE-2023-28100: TIOCLINUX can send commands outside the sandbox if running on a virtual console. This vulnerability could allow an attacker to execute arbitrary commands outside the intended sandboxed environment.
-
CVE-2023-28101: Metadata with ANSI control codes can cause misleading terminal output. This vulnerability could be exploited to manipulate the terminal output and potentially deceive the user.
These vulnerabilities have a moderate impact and could be leveraged by an attacker to gain unauthorized access or deceive users.
How To Fix
Minimum fixed version
1.12.8-1.el9
This is the first release that contains the fix.
sudo dnf update flatpakTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This update addresses two security vulnerabilities in the flatpak package. It is recommended to update the package to version 1.12.8 or later to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for flatpak →
FAQ
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. It provides a secure and isolated environment for running applications.
CVE-2023-28100 allows TIOCLINUX commands to be sent outside the flatpak sandbox if running on a virtual console. This could lead to unauthorized access or execution of arbitrary commands.
CVE-2023-28101 allows metadata with ANSI control codes to manipulate terminal output, potentially deceiving the user.
You can update the flatpak package using the package manager of your Linux distribution. Make sure to install version 1.12.8 or later to address the security vulnerabilities.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to update the flatpak package to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for flatpak.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
