Flatpak up to 1.10.7/1.12.7/1.14.3/1.15.3 App escape output

Summaryinfo

A vulnerability was found in Flatpak up to 1.10.7/1.12.7/1.14.3/1.15.3. It has been declared as problematic. This affects an unknown part of the component App Handler. The manipulation results in escape output. This vulnerability is identified as CVE-2023-28101. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Flatpak up to 1.10.7/1.12.7/1.14.3/1.15.3. Affected is some unknown processing of the component App Handler. The manipulation with an unknown input leads to a escape output vulnerability. CWE is classifying the issue as CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. This is going to have an impact on integrity, and availability. CVE summarizes:

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.

The weakness was released 03/16/2023 as GHSA-h43h-fwqx-mpp8. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2023-28101 since 03/10/2023. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 276348 (TencentOS Server 3: flatpak (TSSA-2023:0295)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.10.8, 1.12.8, 1.14.4 or 1.15.4 eliminates this vulnerability. Applying the patch 409e34187de2b2b2c4ef34c79f417be698830f6c is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (276348) and CERT Bund (WID-SEC-2023-2853). Once again VulDB remains the best source for vulnerability data.

Affected

• Open Source CentOS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Gentoo Linux
• Red Hat OpenShift
• Meinberg LANTIME

Productinfo

Name

• Flatpak

Version

• 1.10.0
• 1.10.1
• 1.10.2
• 1.10.3
• 1.10.4
• 1.10.5
• 1.10.6
• 1.10.7
• 1.12.0
• 1.12.1
• 1.12.2
• 1.12.3
• 1.12.4
• 1.12.5
• 1.12.6
• 1.12.7
• 1.14.0
• 1.14.1
• 1.14.2
• 1.14.3
• 1.15.0
• 1.15.1
• 1.15.2
• 1.15.3

License

• open-source

Website

• Product: https://github.com/flatpak/flatpak/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion