Skip to content
OpenAdvisories
High ALAS2-2021-1625 1 CVE

Important: flatpak security update (Amazon Linux 2)

Published Apr 2, 2021 · Updated Apr 6, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-21381: A sandbox escape flaw was found in the way flatpak handled special tokens in ".desktop" files. This flaw allows an attacker to gain access to files that are not ordinarily allowed by the app's permissions. The highest threat from this vulnerability is to confidentiality and integrity. 1936985: CVE-2021-21381 flatpak: "file forwarding" feature can be used to gain unprivileged access to files

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 flatpak 0:1.0.9-10.amzn2.0.1
Amazon Linux · 2 flatpak-builder 0:1.0.0-10.amzn2.0.1
Amazon Linux · 2 flatpak-debuginfo 0:1.0.9-10.amzn2.0.1
Amazon Linux · 2 flatpak-devel 0:1.0.9-10.amzn2.0.1
Amazon Linux · 2 flatpak-libs 0:1.0.9-10.amzn2.0.1

Vulnerabilities 1

  • High 7.1
    CVE-2021-21381

    Sandbox escape via special tokens in .desktop file

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access…

    Flatpak Flatpak flatpak flatpak Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-21381.html