Bug 775365 (CVE-2021-21381, GHSA-xgh4-387p-hqpp)

Summary:	<sys-apps/flatpak-1.10.2: Sandbox break (CVE-2021-21381)
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	asturm, zmedico
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/flatpak/flatpak/security/advisories/GHSA-xgh4-387p-hqpp
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=794568
Whiteboard:	B3 [glsa+]
Package list:	sys-apps/flatpak-1.10.5	Runtime testing required:	---

Description Sam James archtester

2021-03-11 06:54:33 UTC

Description:
"flatpak since 0.9.4 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions."

Please bump to 1.10.2.

Comment 1 Larry the Git Cow gentoo-dev

2021-03-11 07:11:35 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f1015a3fd27008c326e7bd12b5f754ed663b6fdd

commit f1015a3fd27008c326e7bd12b5f754ed663b6fdd
Author:     Zac Medico <zmedico@gentoo.org>
AuthorDate: 2021-03-11 07:10:50 +0000
Commit:     Zac Medico <zmedico@gentoo.org>
CommitDate: 2021-03-11 07:10:59 +0000

    sys-apps/flatpak: Bump to version 1.10.2
    
    Bug: https://bugs.gentoo.org/775365
    Package-Manager: Portage-3.0.17, Repoman-3.0.2
    Signed-off-by: Zac Medico <zmedico@gentoo.org>

 sys-apps/flatpak/Manifest              |   1 +
 sys-apps/flatpak/flatpak-1.10.2.ebuild | 101 +++++++++++++++++++++++++++++++++
 2 files changed, 102 insertions(+)

Comment 2 Andreas Sturmlechner gentoo-dev

2021-06-06 16:14:35 UTC

So, should this be stabilised now...?

Comment 3 Zac Medico gentoo-dev

2021-06-06 17:23:44 UTC

Yes, please stablilize.

Comment 4 Agostino Sarubbo gentoo-dev

2021-06-07 14:15:18 UTC

amd64 stable

Comment 5 Sam James archtester

2021-06-07 23:10:34 UTC

arm64 done

Comment 6 Agostino Sarubbo gentoo-dev

2021-06-09 06:25:44 UTC

x86 stable.

Maintainer(s), please cleanup.
Security, please vote.

Comment 7 NATTkA bot gentoo-dev

2021-10-10 03:56:49 UTC Comment hidden (obsolete)

Unable to check for sanity:

> no match for package: sys-apps/flatpak-1.10.2

Comment 8 NATTkA bot gentoo-dev

2022-02-04 10:29:09 UTC

Unable to check for sanity:

> no match for package: sys-apps/flatpak-1.10.5

Comment 9 Larry the Git Cow gentoo-dev

2023-12-23 09:06:04 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=774692af49b616797706937b258815617e132c83

commit 774692af49b616797706937b258815617e132c83
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-12-23 09:05:21 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2023-12-23 09:05:57 +0000

    [ GLSA 202312-12 ] Flatpak: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/775365
    Bug: https://bugs.gentoo.org/816951
    Bug: https://bugs.gentoo.org/831087
    Bug: https://bugs.gentoo.org/901507
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 glsa-202312-12.xml | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)