CVE-2023-28101
Summary
| CVE | CVE-2023-28101 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-03-16 16:15:00 UTC |
| Updated | 2023-12-23 10:15:00 UTC |
| Description | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust. |
Risk And Classification
Problem Types: CWE-116
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Reject paths given to --filesystem/--persist with special characters · flatpak/flatpak@7fe63f2 · GitHub | MISC | github.com | |
| CVE-2023-28101: Metadata with ANSI control codes can cause misleading terminal output · Advisory · flatpak/flatpak · GitHub | MISC | github.com | |
| cli-transaction: Escape any special characters in the EOL reason · flatpak/flatpak@409e341 · GitHub | MISC | github.com | |
| Flatpak: Multiple Vulnerabilities (GLSA 202312-12) — Gentoo security | security.gentoo.org | ||
| Ensure special characters in permissions and metadata are escaped · flatpak/flatpak@6cac99d · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 161068 Oracle Enterprise Linux Security Update for flatpak (ELSA-2023-6518)
- 161150 Oracle Enterprise Linux Security Update for flatpak (ELSA-2023-7038)
- 181854 Debian Security Update for flatpak (CVE-2023-28101)
- 242294 Red Hat Update for flatpak security (RHSA-2023:6518)
- 242423 Red Hat Update for flatpak security (RHSA-2023:7038)
- 283814 Fedora Security Update for flatpak (FEDORA-2023-b0717d8c45)
- 283849 Fedora Security Update for flatpak (FEDORA-2023-9fbc701e0d)
- 284241 Fedora Security Update for flatpak (FEDORA-2023-508e400dec)
- 710812 Gentoo Linux Flatpak Multiple Vulnerabilities (GLSA 202312-12)
- 753858 SUSE Enterprise Linux Security Update for flatpak (SUSE-SU-2023:1714-1)
- 753859 SUSE Enterprise Linux Security Update for flatpak (SUSE-SU-2023:1713-1)
- 753883 SUSE Enterprise Linux Security Update for flatpak (SUSE-SU-2023:1712-1)
- 941369 AlmaLinux Security Update for flatpak (ALSA-2023:6518)
- 941429 AlmaLinux Security Update for flatpak (ALSA-2023:7038)