Bug 2041590 (CVE-2021-43860)
Summary: | CVE-2021-43860 flatpak: Permissions granted to applications can be hidden from the user at install time | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | amigadave, debarshir, klember, saroy, security-response-team |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | flatpak 1.12.3, flatpak 1.10.6 | Doc Type: | If docs needed, set a value |
Doc Text: |
An incorrect authorization vulnerability was found in Flatpak. Flatpak does not properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime in the case that there's a null byte in the metadata file of an app. This issue allows apps to grant themselves permissions without the user's consent.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2022-05-11 23:15:12 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 2041591, 2041972, 2041973 | ||
Bug Blocks: | 2041595 |
Description
Guilherme de Almeida Suckevicz
2022-01-17 18:52:08 UTC
Created flatpak tracking bugs for this issue: Affects: fedora-all [bug 2041591] This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:1792 https://access.redhat.com/errata/RHSA-2022:1792 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-43860 |