CVE-2022-21682
Description
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and `--nofilesystem=host`.
How to fix
- flatpak flatpak1.10.7, 1.12.4 or later
- flatpak flatpak-builder1.2.2 or later
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APFTBYGJJVJPFVHRXUW5PII5XOAFI4KH/
- debian.org/security/2022/dsa-5049
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IXKBERLJRYV7KXKGXOLI6IOXVBQNN4DP/
- security.gentoo.org/glsa/202312-12
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| flatpak flatpak | v < 1.10.7, 1.11.1 ≤ v < 1.12.4 | 1.10.7, 1.12.4 |
| flatpak flatpak-builder | v < 1.2.2 | 1.2.2 |
| fedoraproject fedora | 35 | — |
| redhat enterprise_linux | 8.0 | — |
| debian debian_linux | 9.0, 10.0, 11.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.