bubblewrap and flatpak security update

2024-09-0500:00:00

linux.oracle.com

bubblewrap

flatpak

security

update

cve-2024-42472

unix

backport

patches

bind-fd option

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

6.9

Confidence

Low

JSON

bubblewrap
[0.4.0-2]

Backport upstream fix to help address CVE-2024-42472 in flatpak
flatpak
[1.12.9-3]
Fix previous changelog entry
[1.12.9-2]
Backport upstream patches for CVE-2024-42472
Require bubblewrap version that has new --bind-fd option backported for
addressing CVE-2024-42472

OSVersionArchitecturePackageVersionFilename
oracle linux8srcbubblewrap< 0.4.0-2.el8_10bubblewrap-0.4.0-2.el8_10.src.rpm
oracle linux8srcbubblewrap< 0.4.0-2.el8_10bubblewrap-0.4.0-2.el8_10.src.rpm
oracle linux8srcflatpak< 1.12.9-3.el8_10flatpak-1.12.9-3.el8_10.src.rpm
oracle linux8srcflatpak< 1.12.9-3.el8_10flatpak-1.12.9-3.el8_10.src.rpm
oracle linux8aarch64bubblewrap< 0.4.0-2.el8_10bubblewrap-0.4.0-2.el8_10.aarch64.rpm
oracle linux8aarch64bubblewrap< 0.4.0-2.el8_10bubblewrap-0.4.0-2.el8_10.aarch64.rpm
oracle linux8aarch64flatpak< 1.12.9-3.el8_10flatpak-1.12.9-3.el8_10.aarch64.rpm
oracle linux8aarch64flatpak-devel< 1.12.9-3.el8_10flatpak-devel-1.12.9-3.el8_10.aarch64.rpm
oracle linux8aarch64flatpak-libs< 1.12.9-3.el8_10flatpak-libs-1.12.9-3.el8_10.aarch64.rpm
oracle linux8noarchflatpak-selinux< 1.12.9-3.el8_10flatpak-selinux-1.12.9-3.el8_10.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
oracle linux	8	src	bubblewrap	< 0.4.0-2.el8_10	bubblewrap-0.4.0-2.el8_10.src.rpm
oracle linux	8	src	bubblewrap	< 0.4.0-2.el8_10	bubblewrap-0.4.0-2.el8_10.src.rpm
oracle linux	8	src	flatpak	< 1.12.9-3.el8_10	flatpak-1.12.9-3.el8_10.src.rpm
oracle linux	8	src	flatpak	< 1.12.9-3.el8_10	flatpak-1.12.9-3.el8_10.src.rpm
oracle linux	8	aarch64	bubblewrap	< 0.4.0-2.el8_10	bubblewrap-0.4.0-2.el8_10.aarch64.rpm
oracle linux	8	aarch64	bubblewrap	< 0.4.0-2.el8_10	bubblewrap-0.4.0-2.el8_10.aarch64.rpm
oracle linux	8	aarch64	flatpak	< 1.12.9-3.el8_10	flatpak-1.12.9-3.el8_10.aarch64.rpm
oracle linux	8	aarch64	flatpak-devel	< 1.12.9-3.el8_10	flatpak-devel-1.12.9-3.el8_10.aarch64.rpm
oracle linux	8	aarch64	flatpak-libs	< 1.12.9-3.el8_10	flatpak-libs-1.12.9-3.el8_10.aarch64.rpm
oracle linux	8	noarch	flatpak-selinux	< 1.12.9-3.el8_10	flatpak-selinux-1.12.9-3.el8_10.noarch.rpm