Skip to content
OpenAdvisories
High ALAS2-2021-1597 1 CVE

Important: flatpak security update (Amazon Linux 2)

Published Feb 17, 2021 · Updated Feb 19, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-21261: A flaw was found in Flatpak. The Flatpak portal D-Bus service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and use them to execute arbitrary code that is outside the sandbox. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 1917430: CVE-2021-21261 flatpak: sandbox escape via spawn portal

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 flatpak 0:1.0.9-10.amzn2
Amazon Linux · 2 flatpak-builder 0:1.0.0-10.amzn2
Amazon Linux · 2 flatpak-debuginfo 0:1.0.9-10.amzn2
Amazon Linux · 2 flatpak-devel 0:1.0.9-10.amzn2
Amazon Linux · 2 flatpak-libs 0:1.0.9-10.amzn2

Vulnerabilities 1

  • High 7.3
    CVE-2021-21261

    Flatpak sandbox escape via spawn portal

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). Th…

    Flatpak Flatpak flatpak flatpak Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-21261.html