Skip to content
OpenAdvisories
Critical RHSA-2024:6356 1 CVE

Red Hat Security Advisory: bubblewrap and flatpak security update

Published Sep 17, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 20

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak 0:1.12.9-3.el9_4
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak-debuginfo 0:1.12.9-3.el9_4
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak-debugsource 0:1.12.9-3.el9_4
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak-libs 0:1.12.9-3.el9_4
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak-libs-debuginfo 0:1.12.9-3.el9_4
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak-selinux 0:1.12.9-3.el9_4
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak-session-helper 0:1.12.9-3.el9_4
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak-session-helper-debuginfo 0:1.12.9-3.el9_4
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak-tests-debuginfo 0:1.12.9-3.el9_4
Red Hat · RHEL 9 enterprise_linux:9::baseos bubblewrap 0:0.4.1-7.el9_4
Red Hat · RHEL 9 enterprise_linux:9::baseos bubblewrap-debuginfo 0:0.4.1-7.el9_4
Red Hat · RHEL 9 enterprise_linux:9::baseos bubblewrap-debugsource 0:0.4.1-7.el9_4
Red Hat · RHEL 9 enterprise_linux:9::crb flatpak 0:1.12.9-3.el9_4
Red Hat · RHEL 9 enterprise_linux:9::crb flatpak-debuginfo 0:1.12.9-3.el9_4
Red Hat · RHEL 9 enterprise_linux:9::crb flatpak-debugsource 0:1.12.9-3.el9_4
Red Hat · RHEL 9 enterprise_linux:9::crb flatpak-devel 0:1.12.9-3.el9_4
Red Hat · RHEL 9 enterprise_linux:9::crb flatpak-libs-debuginfo 0:1.12.9-3.el9_4
Red Hat · RHEL 9 enterprise_linux:9::crb flatpak-session-helper 0:1.12.9-3.el9_4
Red Hat · RHEL 9 enterprise_linux:9::crb flatpak-session-helper-debuginfo 0:1.12.9-3.el9_4
Red Hat · RHEL 9 enterprise_linux:9::crb flatpak-tests-debuginfo 0:1.12.9-3.el9_4

Vulnerabilities 1

  • Critical 10.0
    CVE-2024-42472

    Flatpak may allow access to files outside sandbox for certain apps

    Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, whi…

    Flatpak Flatpak flatpak flatpak Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6356.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-42472
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2305202
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-42472
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-42472
  • article
    https://github.com/containers/bubblewrap/commit/68e75c3091c87583c28a439b45c45627a94d622c
  • article
    https://github.com/containers/bubblewrap/commit/a253257cd298892da43e15201d83f9a02c9b58b5
  • article
    https://github.com/flatpak/flatpak/commit/2cdd1e1e5ae90d7c3a4b60ce2e36e4d609e44e72
  • article
    https://github.com/flatpak/flatpak/commit/3caeb16c31a3ed62d744e2aaf01d684f7991051a
  • article
    https://github.com/flatpak/flatpak/commit/6bd603f6836e9b38b9b937d3b78f3fbf36e7ff75
  • article
    https://github.com/flatpak/flatpak/commit/7c63e53bb2af0aae9097fd2edfd6a9ba9d453e97
  • article
    https://github.com/flatpak/flatpak/commit/8a18137d7e80f0575e8defabf677d81e5cc3a788
  • article
    https://github.com/flatpak/flatpak/commit/db3a785241fda63bf53f0ec12bb519aa5210de19
  • article
    https://github.com/flatpak/flatpak/security/advisories/GHSA-7hgv-f2j8-xw87