Summary
Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.
Security Fix(es):
* flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | bubblewrap | 0.4.1-7.el9_4.alma.1 |
| AlmaLinux · 9 | flatpak | 1.12.9-3.el9_4 |
| AlmaLinux · 9 | flatpak-devel | 1.12.9-3.el9_4 |
| AlmaLinux · 9 | flatpak-libs | 1.12.9-3.el9_4 |
| AlmaLinux · 9 | flatpak-selinux | 1.12.9-3.el9_4 |
| AlmaLinux · 9 | flatpak-session-helper | 1.12.9-3.el9_4 |
Vulnerabilities 1
-
Critical 10.0
Flatpak may allow access to files outside sandbox for certain apps
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, whi…