Flatpak metadata with ANSI control codes can cause misleading terminal output
Résumé
Flatpak metadata with ANSI control codes can cause misleading terminal output
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the flatpak(1) command-line interface by setting other permissions to crafted values that contain non-printable control characters such as ESC. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2023-28101 flatpak Corrigé dans: 1.10.8-0+deb11u1
- Ubuntu UBUNTU-CVE-2023-28101 flatpak
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.gentoo.org
- patch github.com
- patch github.com
- patch github.com