Skip to content
OpenAdvisories
Medium ALAS2-2018-1096 1 CVE

Moderate: flatpak security update (Amazon Linux 2)

Published Oct 24, 2018 · Updated Oct 25, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-6560: It was found that flatpak's D-Bus proxy did not properly filter the access to D-Bus during the authentication protocol. A specially crafted flatpak application could use this flaw to bypass all restrictions imposed by flatpak and have full access to the D-BUS interface. 1542207: CVE-2018-6560 flatpak: sandbox escape in D-Bus filtering by a crafted authentication handshake

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 flatpak 0:0.8.8-4.amzn2
Amazon Linux · 2 flatpak-builder 0:0.8.8-4.amzn2
Amazon Linux · 2 flatpak-debuginfo 0:0.8.8-4.amzn2
Amazon Linux · 2 flatpak-devel 0:0.8.8-4.amzn2
Amazon Linux · 2 flatpak-libs 0:0.8.8-4.amzn2

Vulnerabilities 1

  • Unscored —
    CVE-2018-6560

    In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to th…

    flatpak Debian

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-6560.html