(RHSA-2024:6419) Important: bubblewrap and flatpak security update

2024-09-0511:03:27

access.redhat.com

bubblewrap flatpak security update unprivileged containers cve-2024-42472 unix_ssh exec engine flatpak_access

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

9.7

Confidence

High

JSON

Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.

Security Fix(es):

flatpak: Access to files outside sandbox for apps using persistent= (–persist) (CVE-2024-42472)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
RedHat8x86_64bubblewrap-debuginfo< 0.4.0-2.el8_8bubblewrap-debuginfo-0.4.0-2.el8_8.x86_64.rpm
RedHat8x86_64flatpak-debuginfo< 1.10.7-4.el8_8flatpak-debuginfo-1.10.7-4.el8_8.x86_64.rpm
RedHat8s390xflatpak-debugsource< 1.10.7-4.el8_8flatpak-debugsource-1.10.7-4.el8_8.s390x.rpm
RedHat8ppc64leflatpak-debugsource< 1.10.7-4.el8_8flatpak-debugsource-1.10.7-4.el8_8.ppc64le.rpm
RedHat8s390xbubblewrap-debuginfo< 0.4.0-2.el8_8bubblewrap-debuginfo-0.4.0-2.el8_8.s390x.rpm
RedHat8x86_64flatpak-session-helper< 1.10.7-4.el8_8flatpak-session-helper-1.10.7-4.el8_8.x86_64.rpm
RedHat8x86_64flatpak-libs-debuginfo< 1.10.7-4.el8_8flatpak-libs-debuginfo-1.10.7-4.el8_8.x86_64.rpm
RedHat8s390xflatpak< 1.10.7-4.el8_8flatpak-1.10.7-4.el8_8.s390x.rpm
RedHat8i686flatpak-tests-debuginfo< 1.10.7-4.el8_8flatpak-tests-debuginfo-1.10.7-4.el8_8.i686.rpm
RedHat8s390xflatpak-libs-debuginfo< 1.10.7-4.el8_8flatpak-libs-debuginfo-1.10.7-4.el8_8.s390x.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	8	x86_64	bubblewrap-debuginfo	< 0.4.0-2.el8_8	bubblewrap-debuginfo-0.4.0-2.el8_8.x86_64.rpm
RedHat	8	x86_64	flatpak-debuginfo	< 1.10.7-4.el8_8	flatpak-debuginfo-1.10.7-4.el8_8.x86_64.rpm
RedHat	8	s390x	flatpak-debugsource	< 1.10.7-4.el8_8	flatpak-debugsource-1.10.7-4.el8_8.s390x.rpm
RedHat	8	ppc64le	flatpak-debugsource	< 1.10.7-4.el8_8	flatpak-debugsource-1.10.7-4.el8_8.ppc64le.rpm
RedHat	8	s390x	bubblewrap-debuginfo	< 0.4.0-2.el8_8	bubblewrap-debuginfo-0.4.0-2.el8_8.s390x.rpm
RedHat	8	x86_64	flatpak-session-helper	< 1.10.7-4.el8_8	flatpak-session-helper-1.10.7-4.el8_8.x86_64.rpm
RedHat	8	x86_64	flatpak-libs-debuginfo	< 1.10.7-4.el8_8	flatpak-libs-debuginfo-1.10.7-4.el8_8.x86_64.rpm
RedHat	8	s390x	flatpak	< 1.10.7-4.el8_8	flatpak-1.10.7-4.el8_8.s390x.rpm
RedHat	8	i686	flatpak-tests-debuginfo	< 1.10.7-4.el8_8	flatpak-tests-debuginfo-1.10.7-4.el8_8.i686.rpm
RedHat	8	s390x	flatpak-libs-debuginfo	< 1.10.7-4.el8_8	flatpak-libs-debuginfo-1.10.7-4.el8_8.s390x.rpm