Detections
Analytics
Rocky Linux 8 : flatpak-builder (RLSA-2022:7458)
medium Nessus Plugin ID 167803
Synopsis
The remote Rocky Linux host is missing a security update.Description
The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:7458 advisory.- Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and `--nofilesystem=host`. (CVE-2022-21682)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Update the affected flatpak-builder, flatpak-builder-debuginfo and / or flatpak-builder-debugsource packages.See Also
https://bugzilla.redhat.com/show_bug.cgi?id=2041592
Plugin Details
Severity: Medium
ID: 167803
File Name: rocky_linux_RLSA-2022-7458.nasl
Version: 1.5
Type: local
Published: 11/17/2022
Updated: 11/6/2023
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N
CVSS Score Source: CVE-2022-21682
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:rocky:linux:flatpak-builder, p-cpe:/a:rocky:linux:flatpak-builder-debuginfo, p-cpe:/a:rocky:linux:flatpak-builder-debugsource, cpe:/o:rocky:linux:8
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RockyLinux/release, Host/RockyLinux/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 11/13/2022
Vulnerability Publication Date: 11/13/2022
Reference Information
CVE: CVE-2022-21682