Skip to content
OpenAdvisories
Critical RHSA-2024:6355 1 CVE

Red Hat Security Advisory: bubblewrap and flatpak security update

Published Sep 17, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 20

ReleasePackageFixed in
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream flatpak 0:1.12.7-5.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream flatpak-debuginfo 0:1.12.7-5.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream flatpak-debugsource 0:1.12.7-5.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream flatpak-libs 0:1.12.7-5.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream flatpak-libs-debuginfo 0:1.12.7-5.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream flatpak-selinux 0:1.12.7-5.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream flatpak-session-helper 0:1.12.7-5.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream flatpak-session-helper-debuginfo 0:1.12.7-5.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream flatpak-tests-debuginfo 0:1.12.7-5.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos bubblewrap 0:0.4.1-7.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos bubblewrap-debuginfo 0:0.4.1-7.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos bubblewrap-debugsource 0:0.4.1-7.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::crb flatpak 0:1.12.7-5.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::crb flatpak-debuginfo 0:1.12.7-5.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::crb flatpak-debugsource 0:1.12.7-5.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::crb flatpak-devel 0:1.12.7-5.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::crb flatpak-libs-debuginfo 0:1.12.7-5.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::crb flatpak-session-helper 0:1.12.7-5.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::crb flatpak-session-helper-debuginfo 0:1.12.7-5.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::crb flatpak-tests-debuginfo 0:1.12.7-5.el9_2

Vulnerabilities 1

  • Critical 10.0
    CVE-2024-42472

    Flatpak may allow access to files outside sandbox for certain apps

    Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, whi…

    Flatpak Flatpak flatpak flatpak Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6355.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-42472
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2305202
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-42472
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-42472
  • article
    https://github.com/containers/bubblewrap/commit/68e75c3091c87583c28a439b45c45627a94d622c
  • article
    https://github.com/containers/bubblewrap/commit/a253257cd298892da43e15201d83f9a02c9b58b5
  • article
    https://github.com/flatpak/flatpak/commit/2cdd1e1e5ae90d7c3a4b60ce2e36e4d609e44e72
  • article
    https://github.com/flatpak/flatpak/commit/3caeb16c31a3ed62d744e2aaf01d684f7991051a
  • article
    https://github.com/flatpak/flatpak/commit/6bd603f6836e9b38b9b937d3b78f3fbf36e7ff75
  • article
    https://github.com/flatpak/flatpak/commit/7c63e53bb2af0aae9097fd2edfd6a9ba9d453e97
  • article
    https://github.com/flatpak/flatpak/commit/8a18137d7e80f0575e8defabf677d81e5cc3a788
  • article
    https://github.com/flatpak/flatpak/commit/db3a785241fda63bf53f0ec12bb519aa5210de19
  • article
    https://github.com/flatpak/flatpak/security/advisories/GHSA-7hgv-f2j8-xw87