Flatpak metadata with ANSI control codes can cause misleading terminal output
Summary
Flatpak metadata with ANSI control codes can cause misleading terminal output
Original description
The description as published by the source.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the flatpak(1) command-line interface by setting other permissions to crafted values that contain non-printable control characters such as ESC. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-28101 flatpak Fixed in: 1.10.8-0+deb11u1
- Ubuntu UBUNTU-CVE-2023-28101 flatpak
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.gentoo.org
- patch github.com
- patch github.com
- patch github.com