RedHat: RHSA-2022-1792:01 Moderate: flatpak security and bug fix up...
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: flatpak security and bug fix update
Advisory ID:       RHSA-2022:1792-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:1792
Issue date:        2022-05-10
CVE Names:         CVE-2021-43860 
=====================================================================

1. Summary:

An update for flatpak is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

Flatpak is a system for building, distributing, and running sandboxed
desktop applications on Linux.

Security Fix(es):

* flatpak: Permissions granted to applications can be hidden from the user
at install time (CVE-2021-43860)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.6 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1980438 - [BZ] Disable gvfs plugins when listing flatpak installations
2010533 - Update to 1.8.6
2041590 - CVE-2021-43860 flatpak: Permissions granted to applications can be hidden from the user at install time

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:
flatpak-1.8.7-1.el8.src.rpm

aarch64:
flatpak-1.8.7-1.el8.aarch64.rpm
flatpak-debuginfo-1.8.7-1.el8.aarch64.rpm
flatpak-debugsource-1.8.7-1.el8.aarch64.rpm
flatpak-libs-1.8.7-1.el8.aarch64.rpm
flatpak-libs-debuginfo-1.8.7-1.el8.aarch64.rpm
flatpak-session-helper-1.8.7-1.el8.aarch64.rpm
flatpak-session-helper-debuginfo-1.8.7-1.el8.aarch64.rpm
flatpak-tests-debuginfo-1.8.7-1.el8.aarch64.rpm

noarch:
flatpak-selinux-1.8.7-1.el8.noarch.rpm

ppc64le:
flatpak-1.8.7-1.el8.ppc64le.rpm
flatpak-debuginfo-1.8.7-1.el8.ppc64le.rpm
flatpak-debugsource-1.8.7-1.el8.ppc64le.rpm
flatpak-libs-1.8.7-1.el8.ppc64le.rpm
flatpak-libs-debuginfo-1.8.7-1.el8.ppc64le.rpm
flatpak-session-helper-1.8.7-1.el8.ppc64le.rpm
flatpak-session-helper-debuginfo-1.8.7-1.el8.ppc64le.rpm
flatpak-tests-debuginfo-1.8.7-1.el8.ppc64le.rpm

s390x:
flatpak-1.8.7-1.el8.s390x.rpm
flatpak-debuginfo-1.8.7-1.el8.s390x.rpm
flatpak-debugsource-1.8.7-1.el8.s390x.rpm
flatpak-libs-1.8.7-1.el8.s390x.rpm
flatpak-libs-debuginfo-1.8.7-1.el8.s390x.rpm
flatpak-session-helper-1.8.7-1.el8.s390x.rpm
flatpak-session-helper-debuginfo-1.8.7-1.el8.s390x.rpm
flatpak-tests-debuginfo-1.8.7-1.el8.s390x.rpm

x86_64:
flatpak-1.8.7-1.el8.x86_64.rpm
flatpak-debuginfo-1.8.7-1.el8.i686.rpm
flatpak-debuginfo-1.8.7-1.el8.x86_64.rpm
flatpak-debugsource-1.8.7-1.el8.i686.rpm
flatpak-debugsource-1.8.7-1.el8.x86_64.rpm
flatpak-libs-1.8.7-1.el8.i686.rpm
flatpak-libs-1.8.7-1.el8.x86_64.rpm
flatpak-libs-debuginfo-1.8.7-1.el8.i686.rpm
flatpak-libs-debuginfo-1.8.7-1.el8.x86_64.rpm
flatpak-session-helper-1.8.7-1.el8.x86_64.rpm
flatpak-session-helper-debuginfo-1.8.7-1.el8.i686.rpm
flatpak-session-helper-debuginfo-1.8.7-1.el8.x86_64.rpm
flatpak-tests-debuginfo-1.8.7-1.el8.i686.rpm
flatpak-tests-debuginfo-1.8.7-1.el8.x86_64.rpm

Red Hat CodeReady Linux Builder (v. 8):

aarch64:
flatpak-debuginfo-1.8.7-1.el8.aarch64.rpm
flatpak-debugsource-1.8.7-1.el8.aarch64.rpm
flatpak-devel-1.8.7-1.el8.aarch64.rpm
flatpak-libs-debuginfo-1.8.7-1.el8.aarch64.rpm
flatpak-session-helper-debuginfo-1.8.7-1.el8.aarch64.rpm
flatpak-tests-debuginfo-1.8.7-1.el8.aarch64.rpm

ppc64le:
flatpak-debuginfo-1.8.7-1.el8.ppc64le.rpm
flatpak-debugsource-1.8.7-1.el8.ppc64le.rpm
flatpak-devel-1.8.7-1.el8.ppc64le.rpm
flatpak-libs-debuginfo-1.8.7-1.el8.ppc64le.rpm
flatpak-session-helper-debuginfo-1.8.7-1.el8.ppc64le.rpm
flatpak-tests-debuginfo-1.8.7-1.el8.ppc64le.rpm

s390x:
flatpak-debuginfo-1.8.7-1.el8.s390x.rpm
flatpak-debugsource-1.8.7-1.el8.s390x.rpm
flatpak-devel-1.8.7-1.el8.s390x.rpm
flatpak-libs-debuginfo-1.8.7-1.el8.s390x.rpm
flatpak-session-helper-debuginfo-1.8.7-1.el8.s390x.rpm
flatpak-tests-debuginfo-1.8.7-1.el8.s390x.rpm

x86_64:
flatpak-1.8.7-1.el8.i686.rpm
flatpak-debuginfo-1.8.7-1.el8.i686.rpm
flatpak-debuginfo-1.8.7-1.el8.x86_64.rpm
flatpak-debugsource-1.8.7-1.el8.i686.rpm
flatpak-debugsource-1.8.7-1.el8.x86_64.rpm
flatpak-devel-1.8.7-1.el8.i686.rpm
flatpak-devel-1.8.7-1.el8.x86_64.rpm
flatpak-libs-debuginfo-1.8.7-1.el8.i686.rpm
flatpak-libs-debuginfo-1.8.7-1.el8.x86_64.rpm
flatpak-session-helper-1.8.7-1.el8.i686.rpm
flatpak-session-helper-debuginfo-1.8.7-1.el8.i686.rpm
flatpak-session-helper-debuginfo-1.8.7-1.el8.x86_64.rpm
flatpak-tests-debuginfo-1.8.7-1.el8.i686.rpm
flatpak-tests-debuginfo-1.8.7-1.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-43860
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYnqQZ9zjgjWX9erEAQiemRAApod+N0LKbeVNEFoyq/wtxgCRnbLcUn29
jul1MlH7DVoCqM5euSE/pKcYIcfoBN96r7H1aSIzR1KjbzU17LxOe5CmRfpFuxx6
9dcE9+6oskA8hTXp00FHtlaSKmhS+kJg7Gn0wqsRq6I3K0CfDVsBfjuCPlfRtSfq
J/SSr9/xbo8IfMmNbSkSPCOuHit+Kjvhf5XY1+o7c2dycUUYc7PNob+xuc2k6s55
XDE/t5NTa2qlg89ksc5N8tBo3jgGHrOWALfXyLtE9+khaeE7ot+6tahVu8EaPObK
WwsmalvCJOwqqtmoIJaaMGQcO1hbP9BAt2IpMmhmxI/YDyJKx3StMhctgR1FodK8
9oLQJv3XIuPMBP4W1vfjcleU4pFcTUIW12v9Yc9OZOnqCKp13+w5CxxMIevtceIb
FRS8tq9eqElGCOHkdaHiZC1qMXGMNLXg58cJHK6FnZagg79gNeQbKKBU5R+fOVPL
j31dzVJdW8Ya4aaHhG6d43eq76fSTkeFbFmNOOptf8WZry0MDu7Nlk9DDElopaMq
MKjctwpNnnU2ZFbstQmtkr3xt/mHesUOqcJa692oN9hq0FN1fGlVODQ87KfymZQx
hSTIrh7mVK0UrZMjspyRB45D4g+EmQNiYOFbmOeuH32GG9n4rpio9pABEc3XEjK2
3uA4t0CKzfA=
=Q70w
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-1792:01 Moderate: flatpak security and bug fix update

An update for flatpak is now available for Red Hat Enterprise Linux 8

Summary

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
* flatpak: Permissions granted to applications can be hidden from the user at install time (CVE-2021-43860)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changesdescribed in this advisory, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2021-43860 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/

Package List

Red Hat Enterprise Linux AppStream (v. 8):
Source: flatpak-1.8.7-1.el8.src.rpm
aarch64: flatpak-1.8.7-1.el8.aarch64.rpm flatpak-debuginfo-1.8.7-1.el8.aarch64.rpm flatpak-debugsource-1.8.7-1.el8.aarch64.rpm flatpak-libs-1.8.7-1.el8.aarch64.rpm flatpak-libs-debuginfo-1.8.7-1.el8.aarch64.rpm flatpak-session-helper-1.8.7-1.el8.aarch64.rpm flatpak-session-helper-debuginfo-1.8.7-1.el8.aarch64.rpm flatpak-tests-debuginfo-1.8.7-1.el8.aarch64.rpm
noarch: flatpak-selinux-1.8.7-1.el8.noarch.rpm
ppc64le: flatpak-1.8.7-1.el8.ppc64le.rpm flatpak-debuginfo-1.8.7-1.el8.ppc64le.rpm flatpak-debugsource-1.8.7-1.el8.ppc64le.rpm flatpak-libs-1.8.7-1.el8.ppc64le.rpm flatpak-libs-debuginfo-1.8.7-1.el8.ppc64le.rpm flatpak-session-helper-1.8.7-1.el8.ppc64le.rpm flatpak-session-helper-debuginfo-1.8.7-1.el8.ppc64le.rpm flatpak-tests-debuginfo-1.8.7-1.el8.ppc64le.rpm
s390x: flatpak-1.8.7-1.el8.s390x.rpm flatpak-debuginfo-1.8.7-1.el8.s390x.rpm flatpak-debugsource-1.8.7-1.el8.s390x.rpm flatpak-libs-1.8.7-1.el8.s390x.rpm flatpak-libs-debuginfo-1.8.7-1.el8.s390x.rpm flatpak-session-helper-1.8.7-1.el8.s390x.rpm flatpak-session-helper-debuginfo-1.8.7-1.el8.s390x.rpm flatpak-tests-debuginfo-1.8.7-1.el8.s390x.rpm
x86_64: flatpak-1.8.7-1.el8.x86_64.rpm flatpak-debuginfo-1.8.7-1.el8.i686.rpm flatpak-debuginfo-1.8.7-1.el8.x86_64.rpm flatpak-debugsource-1.8.7-1.el8.i686.rpm flatpak-debugsource-1.8.7-1.el8.x86_64.rpm flatpak-libs-1.8.7-1.el8.i686.rpm flatpak-libs-1.8.7-1.el8.x86_64.rpm flatpak-libs-debuginfo-1.8.7-1.el8.i686.rpm flatpak-libs-debuginfo-1.8.7-1.el8.x86_64.rpm flatpak-session-helper-1.8.7-1.el8.x86_64.rpm flatpak-session-helper-debuginfo-1.8.7-1.el8.i686.rpm flatpak-session-helper-debuginfo-1.8.7-1.el8.x86_64.rpm flatpak-tests-debuginfo-1.8.7-1.el8.i686.rpm flatpak-tests-debuginfo-1.8.7-1.el8.x86_64.rpm
Red Hat CodeReady Linux Builder (v. 8):
aarch64: flatpak-debuginfo-1.8.7-1.el8.aarch64.rpm flatpak-debugsource-1.8.7-1.el8.aarch64.rpm flatpak-devel-1.8.7-1.el8.aarch64.rpm flatpak-libs-debuginfo-1.8.7-1.el8.aarch64.rpm flatpak-session-helper-debuginfo-1.8.7-1.el8.aarch64.rpm flatpak-tests-debuginfo-1.8.7-1.el8.aarch64.rpm
ppc64le: flatpak-debuginfo-1.8.7-1.el8.ppc64le.rpm flatpak-debugsource-1.8.7-1.el8.ppc64le.rpm flatpak-devel-1.8.7-1.el8.ppc64le.rpm flatpak-libs-debuginfo-1.8.7-1.el8.ppc64le.rpm flatpak-session-helper-debuginfo-1.8.7-1.el8.ppc64le.rpm flatpak-tests-debuginfo-1.8.7-1.el8.ppc64le.rpm
s390x: flatpak-debuginfo-1.8.7-1.el8.s390x.rpm flatpak-debugsource-1.8.7-1.el8.s390x.rpm flatpak-devel-1.8.7-1.el8.s390x.rpm flatpak-libs-debuginfo-1.8.7-1.el8.s390x.rpm flatpak-session-helper-debuginfo-1.8.7-1.el8.s390x.rpm flatpak-tests-debuginfo-1.8.7-1.el8.s390x.rpm
x86_64: flatpak-1.8.7-1.el8.i686.rpm flatpak-debuginfo-1.8.7-1.el8.i686.rpm flatpak-debuginfo-1.8.7-1.el8.x86_64.rpm flatpak-debugsource-1.8.7-1.el8.i686.rpm flatpak-debugsource-1.8.7-1.el8.x86_64.rpm flatpak-devel-1.8.7-1.el8.i686.rpm flatpak-devel-1.8.7-1.el8.x86_64.rpm flatpak-libs-debuginfo-1.8.7-1.el8.i686.rpm flatpak-libs-debuginfo-1.8.7-1.el8.x86_64.rpm flatpak-session-helper-1.8.7-1.el8.i686.rpm flatpak-session-helper-debuginfo-1.8.7-1.el8.i686.rpm flatpak-session-helper-debuginfo-1.8.7-1.el8.x86_64.rpm flatpak-tests-debuginfo-1.8.7-1.el8.i686.rpm flatpak-tests-debuginfo-1.8.7-1.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2022:1792-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:1792
Issued Date: : 2022-05-10
CVE Names: CVE-2021-43860

Topic

An update for flatpak is now available for Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Relevant Releases Architectures

Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

Bugs Fixed

1980438 - [BZ] Disable gvfs plugins when listing flatpak installations

2010533 - Update to 1.8.6

2041590 - CVE-2021-43860 flatpak: Permissions granted to applications can be hidden from the user at install time

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.