Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance, either with the same security settings as the caller or with more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3284-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug     was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary     code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and     before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by     its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their     own subprocesses in a new sandbox instance, either with the same security settings as the caller or with     more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as     Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a     more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service     passes caller-specified environment variables to non-sandboxed processes on the host system, and in     particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or     compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and     use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be     mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many     Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0. (CVE-2021-21261)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used     by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the     Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating     the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in     order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act     as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the     privileges that the corresponding services will believe the Flatpak app has. Note that protocols that     operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected     by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by     the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as     of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from     upgrading to a patched version. (CVE-2021-41133)

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6,     Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time     match the actual permissions granted to the app at runtime, in the case that there's a null byte in the     metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user.
    Flatpak shows permissions to the user during install by reading them from the xa.metadata key in the     commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak     compares these permissions to the *actual* metadata, from the metadata file to ensure it wasn't lied to.
    However, the actual metadata contents are loaded in several places where they are read as simple C-style     strings. That means that, if the metadata file includes a null terminator, only the content of the file     from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the     metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously     crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted     sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an     update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the     permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.
    (CVE-2021-43860)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2990-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug     was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary     code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and     before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by     its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their     own subprocesses in a new sandbox instance, either with the same security settings as the caller or with     more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as     Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a     more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service     passes caller-specified environment variables to non-sandboxed processes on the host system, and in     particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or     compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and     use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be     mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many     Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0. (CVE-2021-21261)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the file forwarding     feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by     the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak     app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had     chosen to open a target file with their Flatpak app, which automatically makes that file available to the     Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit `Disallow @@ and @@U     usage in desktop files`. The follow-up commits `dir: Reserve the whole @@ prefix` and `dir: Refuse to     export .desktop files with suspicious uses of @@ tokens` are recommended, but not strictly required. As a     workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported     `.desktop` files in `exports/share/applications/*.desktop` (typically     `~/.local/share/flatpak/exports/share/applications/*.desktop` and     `/var/lib/flatpak/exports/share/applications/*.desktop`) to make sure that literal filenames do not follow     `@@` or `@@u`. (CVE-2021-21381)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has flatpak packages installed that are affected by a vulnerability:

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug     was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary     code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and     before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by     its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their     own subprocesses in a new sandbox instance, either with the same security settings as the caller or with     more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as     Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a     more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service     passes caller-specified environment variables to non-sandboxed processes on the host system, and in     particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or     compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and     use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be     mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many     Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0. (CVE-2021-21261)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has flatpak packages installed that are affected by a vulnerability:

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug     was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary     code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and     before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by     its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their     own subprocesses in a new sandbox instance, either with the same security settings as the caller or with     more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as     Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a     more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service     passes caller-specified environment variables to non-sandboxed processes on the host system, and in     particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or     compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and     use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be     mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many     Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0. (CVE-2021-21261)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has flatpak packages installed that are affected by a vulnerability:

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug     was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary     code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and     before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by     its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their     own subprocesses in a new sandbox instance, either with the same security settings as the caller or with     more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as     Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a     more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service     passes caller-specified environment variables to non-sandboxed processes on the host system, and in     particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or     compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and     use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be     mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many     Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0. (CVE-2021-21261)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the flatpak packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Flatpak is a system for building, distributing, and     running sandboxed desktop applications on Linux. A bug     was discovered in the `flatpak-portal` service that can     allow sandboxed applications to execute arbitrary code     on the host system (a sandbox escape). This     sandbox-escape bug is present in versions from 0.11.4     and before fixed versions 1.8.5 and 1.10.0. The Flatpak     portal D-Bus service (`flatpak-portal`, also known by     its D-Bus service name     `org.freedesktop.portal.Flatpak`) allows apps in a     Flatpak sandbox to launch their own subprocesses in a     new sandbox instance, either with the same security     settings as the caller or with more restrictive     security settings. For example, this is used in     Flatpak-packaged web browsers such as Chromium to     launch subprocesses that will process untrusted web     content, and give those subprocesses a more restrictive     sandbox than the browser itself. In vulnerable     versions, the Flatpak portal service passes     caller-specified environment variables to non-sandboxed     processes on the host system, and in particular to the     `flatpak run` command that is used to launch the new     sandbox instance. A malicious or compromised Flatpak     app could set environment variables that are trusted by     the `flatpak run` command, and use them to execute     arbitrary code that is not in a sandbox. As a     workaround, this vulnerability can be mitigated by     preventing the `flatpak-portal` service from starting,     but that mitigation will prevent many Flatpak apps from     working correctly. This is fixed in versions 1.8.5 and     1.10.0.(CVE-2021-21261)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for flatpak, libostree, xdg-desktop-portal, xdg-desktop-portal-gtk fixes the following issues :

libostree :

Update to version 2020.8

  - Enable LTO. (bsc#1133120)

  - This update contains scalability improvements and     bugfixes.

  - Caching-related HTTP headers are now supported on     summaries and signatures, so that they do not have to be     re-downloaded if not changed in the meanwhile.

  - Summaries and delta have been reworked to allow more     fine-grained fetching.

  - Fixes several bugs related to atomic variables, HTTP     timeouts, and 32-bit architectures.

  - Static deltas can now be signed to more easily support     offline verification.

  - There's now support for multiple initramfs images; Is it     possible to have a 'main' initramfs image and a     secondary one which represents local configuration.

  - The documentation is now moved to     https://ostreedev.github.io/ostree/

  - Fix for an assertion failure when upgrading from systems     before ostree supported devicetree.

  - ostree no longer hardlinks zero sized files to avoid     hitting filesystem maximum link counts.

  - ostree now supports `/` and `/boot` being on the same     filesystem.

  - Improvements to the GObject Introspection metadata, some     (cosmetic) static analyzer fixes, a fix for the     immutable bit on s390x, dropping a deprecated bit in the     systemd unit file.

  - Fix a regression 2020.4 where the 'readonly sysroot'     changes incorrectly left the sysroot read-only on     systems that started out with a read-only `/` (most of     them, e.g. Fedora Silverblue/IoT at least).

  - The default dracut config now enables reproducibility.

  - There is a new ostree admin unlock `--transient`. This     should to be a foundation for further support for 'live'     updates.

  - New `ed25519` signing support, powered by `libsodium`.

  - stree commit gained a new `--base` argument, which     significantly simplifies constructing 'derived' commits,     particularly for systems using SELinux.

  - Handling of the read-only sysroot was reimplemented to     run in the initramfs and be more reliable. Enabling the     `readonly=true` flag in the repo config is recommended.

  - Several fixes in locking for the temporary 'staging'     directories OSTree creates, particularly on NFS.

  - A new `timestamp-check-from-rev` option was added for     pulls, which makes downgrade protection more reliable     and will be used by Fedora CoreOS.

  - Several fixes and enhancements made for 'collection'     pulls including a new `--mirror` option.

  - The ostree commit command learned a new     `--mode-ro-executables` which enforces `W^R` semantics     on all executables.

  - Added a new commit metadata key     `OSTREE_COMMIT_META_KEY_ARCHITECTURE` to help     standardize the architecture of the OSTree commit. This     could be used on the client side for example to     sanity-check that the commit matches the architecture of     the machine before deploying.

  - Stop invalid usage of `%_libexecdir` :

  + Use `%(_prefix)/lib` where appropriate.

  + Use `_systemdgeneratordir` for the systemd-generators.

  + Define `_dracutmodulesdir` based on `dracut.pc`. Add     BuildRequires(dracut) for this to work.

xdg-desktop-portal :

Update to version 1.8.0 :

  - Ensure systemd rpm macros are called at     install/uninstall times for systemd user services.

  - Add BuildRequires on systemd-rpm-macros.

  - openuri :

  - Allow skipping the chooser for more URL tyles

  - Robustness fixes

  - filechooser :

  - Return the current filter

  - Add a 'directory' option

  - Document the 'writable' option

  - camera :

  - Make the client node visible

  - Don't leak pipewire proxy

  - Fix file descriptor leaks

  - Testsuite improvements

  - Updated translations.

  - document :

  - Reduce the use of open fds

  - Add more tests and fix issues they found

  - Expose directories with their proper name

  - Support exporting directories

  - New fuse implementation

  - background: Avoid a segfault

  - screencast: Require pipewire 0.3

  - Better support for snap and toolbox

  - Require `/usr/bin/fusermount`: `xdg-document-portal`     calls out to the binary. (bsc#1175899) Without it, files     or dirs can be selected, but whatever is done with or in     them, will not have any effect

  - Fixes for `%_libexecdir` changing to `/usr/libexec`

xdg-desktop-portal-gtk :

Update to version 1.8.0 :

  - filechooser :

  - Return the current filter

  - Handle the 'directory' option to select directories

  - Only show preview when we have an image

  - screenshot: Fix cancellation

  - appchooser: Avoid a crash

  - wallpaper :

  - Properly preview placement settings

  - Drop the lockscreen option

  - printing: Improve the notification

  - Updated translations.

  - settings: Fall back to gsettings for enable-animations

  - screencast: Support Mutter version to 3 (New pipewire     api ver 3).

flatpak :

  - Update to version 1.10.2 (jsc#SLE-17238, ECO-3148)

  - This is a security update which fixes a potential attack     where a flatpak application could use custom formated     `.desktop` file to gain access to files on the host     system.

  - Fix memory leaks

  - Documentation and translations updates

  - Spawn portal better handles non-utf8 filenames

  - Fix flatpak build on systems with setuid bwrap 

  - Fix crash on updating apps with no deploy data

  - Remove deprecated texinfo packaging macros.

  - Support for the new repo format which should make     updates faster and download less data.

  - The systemd generator snippets now call flatpak     `--print-updated-env` in place of a bunch of shell for     better login performance.

  - The `.profile` snippets now disable GVfs when calling     flatpak to avoid spawning a gvfs daemon when logging in     via ssh.

  - Flatpak now finds the pulseaudio sockets better in     uncommon configurations.

  - Sandboxes with network access it now also has access to     the `systemd-resolved` socket to do dns lookups.

  - Flatpak supports unsetting environment variables in the     sandbox using `--unset-env`, and `--env=FOO=` now sets     FOO to the empty string instead of unsetting it.

  - The spawn portal now has an option to share the pid     namespace with the sub-sandbox.

  - This security update fixes a sandbox escape where a     malicious application can execute code outside the     sandbox by controlling the environment of the 'flatpak     run' command when spawning a sub-sandbox (bsc#1180996,     CVE-2021-21261)

  - Fix support for ppc64.

  - Move flatpak-bisect and flatpak-coredumpctl to devel     subpackage, allow to remove python3 dependency on main     package.

  - Enable LTO as gobject-introspection works fine with LTO.
    (bsc#1133124)

  - Fixed progress reporting for OCI and extra-data.

  - The in-memory summary cache is more efficient.

  - Fixed authentication getting stuck in a loop in some     cases.

  - Fixed authentication error reporting.

  - Extract OCI info for runtimes as well as apps. 

  - Fixed crash if anonymous authentication fails and `-y`     is specified.

  - flatpak info now only looks at the specified     installation if one is specified.

  - Better error reporting for server HTTP errors during     download. 

  - Uninstall now removes applications before the runtime it     depends on.

  - Avoid updating metadata from the remote when     uninstalling.

  - FlatpakTransaction now verifies all passed in refs to     avoid.

  - Added validation of collection id settings for remotes.

  - Fix seccomp filters on s390.

  - Robustness fixes to the spawn portal.

  - Fix support for masking update in the system     installation.

  - Better support for distros with uncommon models of     merged `/usr`.

  - Cache responses from localed/AccountService.

  - Fix hangs in cases where `xdg-dbus-proxy` fails to     start.

  - Fix double-free in cups socket detection.

  - OCI authenticator now doesn't ask for auth in case of     http errors.

  - Fix invalid usage of `%(_libexecdir)` to reference     systemd directories.

  - Fixes for `%_libexecdir` changing to `/usr/libexec`

  - Avoid calling authenticator in update if ref didn't     change

  - Don't fail transaction if ref is already installed     (after transaction start)

  - Fix flatpak run handling of userns in the `--device=all`     case

  - Fix handling of extensions from different remotes

  - Fix flatpak run `--no-session-bus`

  - `FlatpakTransaction` has a new signal     `install-authenticator` which clients can handle to     install authenticators needed for the transaction. This     is done in the CLI commands.

  - Now the host timezone data is always exposed, fixing     several apps that had timezone issues.

  - There's a new systemd unit (not installed by default) to     automatically detect plugged in usb sticks with sideload     repos.

  - By default the `gdm env.d` file is no longer installed     because the systemd generators work better.

  - `create-usb` now exports partial commits by default 

  - Fix handling of docker media types in oci remotes

  - Fix subjects in `remote-info --log` output

  - This release is also able to host flatpak images on e.g.
    docker hub. This update was imported from the     SUSE:SLE-15-SP2:Update update project.

This update for flatpak, libostree, xdg-desktop-portal, xdg-desktop-portal-gtk fixes the following issues :

libostree :

Update to version 2020.8

Enable LTO. (bsc#1133120)

This update contains scalability improvements and bugfixes.

Caching-related HTTP headers are now supported on summaries and signatures, so that they do not have to be re-downloaded if not changed in the meanwhile.

Summaries and delta have been reworked to allow more fine-grained fetching.

Fixes several bugs related to atomic variables, HTTP timeouts, and 32-bit architectures.

Static deltas can now be signed to more easily support offline verification.

There's now support for multiple initramfs images; Is it possible to have a 'main' initramfs image and a secondary one which represents local configuration.

The documentation is now moved to https://ostreedev.github.io/ostree/

Fix for an assertion failure when upgrading from systems before ostree supported devicetree.

ostree no longer hardlinks zero sized files to avoid hitting filesystem maximum link counts.

ostree now supports `/` and `/boot` being on the same filesystem.

Improvements to the GObject Introspection metadata, some (cosmetic) static analyzer fixes, a fix for the immutable bit on s390x, dropping a deprecated bit in the systemd unit file.

Fix a regression 2020.4 where the 'readonly sysroot' changes incorrectly left the sysroot read-only on systems that started out with a read-only `/` (most of them, e.g. Fedora Silverblue/IoT at least).

The default dracut config now enables reproducibility.

There is a new ostree admin unlock `--transient`. This should to be a foundation for further support for 'live' updates.

New `ed25519` signing support, powered by `libsodium`.

stree commit gained a new `--base` argument, which significantly simplifies constructing 'derived' commits, particularly for systems using SELinux.

Handling of the read-only sysroot was reimplemented to run in the initramfs and be more reliable. Enabling the `readonly=true` flag in the repo config is recommended.

Several fixes in locking for the temporary 'staging' directories OSTree creates, particularly on NFS.

A new `timestamp-check-from-rev` option was added for pulls, which makes downgrade protection more reliable and will be used by Fedora CoreOS.

Several fixes and enhancements made for 'collection' pulls including a new `--mirror` option.

The ostree commit command learned a new `--mode-ro-executables` which enforces `W^R` semantics on all executables.

Added a new commit metadata key `OSTREE_COMMIT_META_KEY_ARCHITECTURE` to help standardize the architecture of the OSTree commit. This could be used on the client side for example to sanity-check that the commit matches the architecture of the machine before deploying.

Stop invalid usage of `%_libexecdir` :

  + Use `%{_prefix}/lib` where appropriate.

  + Use `_systemdgeneratordir` for the systemd-generators.

  + Define `_dracutmodulesdir` based on `dracut.pc`. Add     BuildRequires(dracut) for this to work.

xdg-desktop-portal :

Update to version 1.8.0 :

Ensure systemd rpm macros are called at install/uninstall times for systemd user services.

Add BuildRequires on systemd-rpm-macros.

openuri :

  - Allow skipping the chooser for more URL tyles

  - Robustness fixes

filechooser :

  - Return the current filter

  - Add a 'directory' option

  - Document the 'writable' option

camera :

  - Make the client node visible

  - Don't leak pipewire proxy

Fix file descriptor leaks

Testsuite improvements

Updated translations.

document :

  - Reduce the use of open fds

  - Add more tests and fix issues they found

  - Expose directories with their proper name

  - Support exporting directories

  - New fuse implementation

background: Avoid a segfault

screencast: Require pipewire 0.3

Better support for snap and toolbox

Require `/usr/bin/fusermount`: `xdg-document-portal` calls out to the binary. (bsc#1175899) Without it, files or dirs can be selected, but whatever is done with or in them, will not have any effect

Fixes for `%_libexecdir` changing to `/usr/libexec`

xdg-desktop-portal-gtk :

Update to version 1.8.0 :

filechooser :

  - Return the current filter

  - Handle the 'directory' option to select directories

  - Only show preview when we have an image

screenshot: Fix cancellation

appchooser: Avoid a crash

wallpaper :

  - Properly preview placement settings

  - Drop the lockscreen option

printing: Improve the notification

Updated translations.

settings: Fall back to gsettings for enable-animations

screencast: Support Mutter version to 3 (New pipewire api ver 3).

flatpak :

Update to version 1.10.2 (jsc#SLE-17238, ECO-3148)

This is a security update which fixes a potential attack where a flatpak application could use custom formated `.desktop` file to gain access to files on the host system.

Fix memory leaks

Documentation and translations updates

Spawn portal better handles non-utf8 filenames

Fix flatpak build on systems with setuid bwrap

Fix crash on updating apps with no deploy data

Remove deprecated texinfo packaging macros.

Support for the new repo format which should make updates faster and download less data.

The systemd generator snippets now call flatpak `--print-updated-env` in place of a bunch of shell for better login performance.

The `.profile` snippets now disable GVfs when calling flatpak to avoid spawning a gvfs daemon when logging in via ssh.

Flatpak now finds the pulseaudio sockets better in uncommon configurations.

Sandboxes with network access it now also has access to the `systemd-resolved` socket to do dns lookups.

Flatpak supports unsetting environment variables in the sandbox using `--unset-env`, and `--env=FOO=` now sets FOO to the empty string instead of unsetting it.

The spawn portal now has an option to share the pid namespace with the sub-sandbox.

This security update fixes a sandbox escape where a malicious application can execute code outside the sandbox by controlling the environment of the 'flatpak run' command when spawning a sub-sandbox (bsc#1180996, CVE-2021-21261)

Fix support for ppc64.

Move flatpak-bisect and flatpak-coredumpctl to devel subpackage, allow to remove python3 dependency on main package.

Enable LTO as gobject-introspection works fine with LTO. (bsc#1133124)

Fixed progress reporting for OCI and extra-data.

The in-memory summary cache is more efficient.

Fixed authentication getting stuck in a loop in some cases.

Fixed authentication error reporting.

Extract OCI info for runtimes as well as apps.

Fixed crash if anonymous authentication fails and `-y` is specified.

flatpak info now only looks at the specified installation if one is specified.

Better error reporting for server HTTP errors during download.

Uninstall now removes applications before the runtime it depends on.

Avoid updating metadata from the remote when uninstalling.

FlatpakTransaction now verifies all passed in refs to avoid.

Added validation of collection id settings for remotes.

Fix seccomp filters on s390.

Robustness fixes to the spawn portal.

Fix support for masking update in the system installation.

Better support for distros with uncommon models of merged `/usr`.

Cache responses from localed/AccountService.

Fix hangs in cases where `xdg-dbus-proxy` fails to start.

Fix double-free in cups socket detection.

OCI authenticator now doesn't ask for auth in case of http errors.

Fix invalid usage of `%{_libexecdir}` to reference systemd directories.

Fixes for `%_libexecdir` changing to `/usr/libexec`

Avoid calling authenticator in update if ref didn't change

Don't fail transaction if ref is already installed (after transaction start)

Fix flatpak run handling of userns in the `--device=all` case

Fix handling of extensions from different remotes

Fix flatpak run `--no-session-bus`

`FlatpakTransaction` has a new signal `install-authenticator` which clients can handle to install authenticators needed for the transaction. This is done in the CLI commands.

Now the host timezone data is always exposed, fixing several apps that had timezone issues.

There's a new systemd unit (not installed by default) to automatically detect plugged in usb sticks with sideload repos.

By default the `gdm env.d` file is no longer installed because the systemd generators work better.

`create-usb` now exports partial commits by default

Fix handling of docker media types in oci remotes

Fix subjects in `remote-info --log` output

This release is also able to host flatpak images on e.g. docker hub.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of flatpak installed on the remote host is prior to 1.0.9-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1597 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug     was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary     code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and     before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by     its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their     own subprocesses in a new sandbox instance, either with the same security settings as the caller or with     more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as     Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a     more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service     passes caller-specified environment variables to non-sandboxed processes on the host system, and in     particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or     compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and     use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be     mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many     Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0. (CVE-2021-21261)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:0411 advisory.

  - flatpak: sandbox escape via spawn portal (CVE-2021-21261)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:0411-1 advisory.

  - flatpak: sandbox escape via spawn portal (CVE-2021-21261)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0411 advisory.

  - flatpak: sandbox escape via spawn portal (CVE-2021-21261)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 20.10 host has packages installed that are affected by a vulnerability as referenced in the USN-4721-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug     was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary     code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and     before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by     its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their     own subprocesses in a new sandbox instance, either with the same security settings as the caller or with     more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as     Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a     more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service     passes caller-specified environment variables to non-sandboxed processes on the host system, and in     particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or     compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and     use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be     mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many     Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0. (CVE-2021-21261)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0411 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug     was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary     code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and     before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by     its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their     own subprocesses in a new sandbox instance, either with the same security settings as the caller or with     more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as     Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a     more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service     passes caller-specified environment variables to non-sandboxed processes on the host system, and in     particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or     compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and     use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be     mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many     Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0. (CVE-2021-21261)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:0304 advisory.

  - flatpak: sandbox escape via spawn portal (CVE-2021-21261)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0304 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug     was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary     code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and     before fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by     its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their     own subprocesses in a new sandbox instance, either with the same security settings as the caller or with     more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as     Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a     more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service     passes caller-specified environment variables to non-sandboxed processes on the host system, and in     particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or     compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and     use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be     mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many     Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0. (CVE-2021-21261)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0307 advisory.

  - flatpak: sandbox escape via spawn portal (CVE-2021-21261)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0306 advisory.

  - flatpak: sandbox escape via spawn portal (CVE-2021-21261)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0304 advisory.

  - flatpak: sandbox escape via spawn portal (CVE-2021-21261)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202101-21 (Flatpak: Sandbox escape)

    A bug was discovered in the flatpak-portal service that can allow       sandboxed applications to execute arbitrary code on the host system (a       sandbox escape).
  Impact :

    A remote attacker could entice a user to open a specially crafted       Flatpak app possibly resulting in execution of arbitrary code with the       privileges of the process or a Denial of Service condition.
  Workaround :

    As a workaround, this vulnerability can be mitigated by preventing the       flatpak-portal service from starting, but that mitigation will prevent       many Flatpak apps from working correctly. It is highly recommended to       upgrade.

Simon McVittie discovered a bug in the flatpak-portal service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape).

The Flatpak portal D-Bus service (flatpak-portal, also known by its D-Bus service name org.freedesktop.portal.Flatpak) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance, either with the same security settings as the caller or with more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a more restrictive sandbox than the browser itself.

In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the flatpak run command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the flatpak run command, and use them to execute arbitrary code that is not in a sandbox.

ID	Name	Product	Family	Severity
165227	SUSE SLES15 Security Update : flatpak (SUSE-SU-2022:3284-1)	Nessus	SuSE Local Security Checks	high
164642	SUSE SLES15 Security Update : flatpak (SUSE-SU-2022:2990-1)	Nessus	SuSE Local Security Checks	high
154585	NewStart CGSL CORE 5.04 / MAIN 5.04 : flatpak Vulnerability (NS-SA-2021-0096)	Nessus	NewStart CGSL Local Security Checks	high
154499	NewStart CGSL MAIN 6.02 : flatpak Vulnerability (NS-SA-2021-0122)	Nessus	NewStart CGSL Local Security Checks	high
154455	NewStart CGSL CORE 5.05 / MAIN 5.05 : flatpak Vulnerability (NS-SA-2021-0181)	Nessus	NewStart CGSL Local Security Checks	high
152320	EulerOS 2.0 SP8 : flatpak (EulerOS-SA-2021-2294)	Nessus	Huawei Local Security Checks	high
148417	openSUSE Security Update : flatpak / libostree / xdg-desktop-portal / etc (openSUSE-2021-520)	Nessus	SuSE Local Security Checks	high
148387	SUSE SLED15 / SLES15 Security Update : flatpak, libostree, xdg-desktop-portal, xdg-desktop-portal-gtk (SUSE-SU-2021:1094-1)	Nessus	SuSE Local Security Checks	high
146624	Amazon Linux 2 : flatpak (ALAS-2021-1597)	Nessus	Amazon Linux Local Security Checks	high
146315	CentOS 7 : flatpak (CESA-2021:0411)	Nessus	CentOS Local Security Checks	high
146270	Scientific Linux Security Update : flatpak on SL7.x x86_64 (2021:0411)	Nessus	Scientific Linux Local Security Checks	high
146210	RHEL 7 : flatpak (RHSA-2021:0411)	Nessus	Red Hat Local Security Checks	high
146208	Ubuntu 18.04 LTS / 20.04 LTS : Flatpak vulnerability (USN-4721-1)	Nessus	Ubuntu Local Security Checks	high
146195	Oracle Linux 7 : flatpak (ELSA-2021-0411)	Nessus	Oracle Linux Local Security Checks	high
146089	CentOS 8 : flatpak (CESA-2021:0304)	Nessus	CentOS Local Security Checks	high
146046	Oracle Linux 8 : flatpak (ELSA-2021-0304)	Nessus	Oracle Linux Local Security Checks	high
145790	RHEL 8 : flatpak (RHSA-2021:0307)	Nessus	Red Hat Local Security Checks	high
145787	RHEL 8 : flatpak (RHSA-2021:0306)	Nessus	Red Hat Local Security Checks	high
145704	RHEL 8 : flatpak (RHSA-2021:0304)	Nessus	Red Hat Local Security Checks	high
145369	GLSA-202101-21 : Flatpak: Sandbox escape	Nessus	Gentoo Local Security Checks	high
145021	Debian DSA-4830-1 : flatpak - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-21261

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high