Alerts This Week
Warning Icon 1 770
Alerts This Week
Warning Icon 1 770

SUSE: 2022:2990-1 Important: Flatpak Sandbox Escape Mitigated

suse
Calendar Grey September 1, 2022
Dist Suse Esm H88
SUSE has released a pivotal security update that tackles significant flatpak vulnerabilities, implementing crucial patches and bolstering security protocols.
An update that solves two vulnerabilities and has one errata is now available

Summary

This update for flatpak fixes the following issues: - CVE-2021-21381: Fixed an issue where a sandboxed application could read and write arbitrary host files via special tokens in the .desktop file (bsc#1183459). - CVE-2021-21261: Fixed a sandbox escape issue via the flatpak-portal service (bsc#1180996). Non-security fixes: - openh264 extension needs to use "extra_data". (bsc#1155688) The update will provide the support for extra_data" in extensions and will provide a list of versions that are supported. This will be useful for the extra_data for extensions because that will require it to say that it is supported for version > 1.2.5 in the 1.2 series and > 1.4.2 otherwise. The update will includes fixes for a segfault in the function that lists the installed references

Topics%20covered

Topics Covered

security advisory software update SUSE important fix issue resolution sandbox escape flatpak

References

#1155688 #1180996 #1183459

Cross- CVE-2021-21261 CVE-2021-21381

CVSS scores:

CVE-2021-21261 (NVD) : 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2021-21261 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

CVE-2021-21381 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CVE-2021-21381 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected Products:

SUSE CaaS Platform 4.0

SUSE Enterprise Storage 6

SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS

SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS

SUSE Linux Enterprise Server 15-SP1-BCL

SUSE Linux Enterprise Server 15-SP1-LTSS

SUSE Linux Enterprise Server for SAP 15-SP1

https://www.suse.com/security/cve/CVE-2021-21261.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2022:2990-1
Rating: important

Topics%20covered

Topics Covered

security advisory software update SUSE important fix issue resolution sandbox escape flatpak

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here