CVE-2022-21682
Description
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies finish-args last in the build. At this point the build directory will have the full access that is specified in the manifest, so running flatpak build against it will gain those permissions. Normally this will not be done, so this is not problem. However, if --mirror-screenshots-url is specified, then flatpak-builder will launch flatpak build --nofilesystem=host appstream-utils mirror-screenshots after finalization, which can lead to issues even with the --nofilesystem=host protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the appstream-util binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of --nofilesystem=home and --nofilesystem=host.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
24- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- osv-coords15 versionspkg:rpm/almalinux/flatpak-builderpkg:rpm/opensuse/flatpak&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/flatpak&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/flatpak-builder&distro=openSUSE%20Tumbleweedpkg:rpm/suse/flatpak&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-ESPOSpkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP3pkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP2pkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-BCLpkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/flatpak&distro=SUSE%20Manager%20Proxy%204.1pkg:rpm/suse/flatpak&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.1pkg:rpm/suse/flatpak&distro=SUSE%20Manager%20Server%204.1
< 1.0.14-2.el8+ 14 more
- (no CPE)range: < 1.0.14-2.el8
- (no CPE)range: < 1.10.7-4.12.1
- (no CPE)range: < 1.12.4-1.1
- (no CPE)range: < 1.2.2-1.1
- (no CPE)range: < 1.10.7-4.12.1
- (no CPE)range: < 1.10.7-4.12.1
- (no CPE)range: < 1.10.7-4.12.1
- (no CPE)range: < 1.10.7-4.12.1
- (no CPE)range: < 1.10.7-4.12.1
- (no CPE)range: < 1.10.7-4.12.1
- (no CPE)range: < 1.10.7-4.12.1
- (no CPE)range: < 1.10.7-4.12.1
- (no CPE)range: < 1.10.7-4.12.1
- (no CPE)range: < 1.10.7-4.12.1
- (no CPE)range: < 1.10.7-4.12.1
Patches
Vulnerability mechanics
References
7- github.com/flatpak/flatpak/commit/445bddeee657fdc8d2a0a1f0de12975400d4fc1anvdPatchThird Party Advisory
- github.com/flatpak/flatpak/commit/4d11f77aa7fd3e64cfa80af89d92567ab9e8e6fanvdPatchThird Party Advisory
- github.com/flatpak/flatpak/security/advisories/GHSA-8ch7-5j3h-g4fxnvdPatchThird Party Advisory
- www.debian.org/security/2022/dsa-5049nvdThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APFTBYGJJVJPFVHRXUW5PII5XOAFI4KH/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IXKBERLJRYV7KXKGXOLI6IOXVBQNN4DP/nvd
- security.gentoo.org/glsa/202312-12nvd
News mentions
0No linked articles in our index yet.