CVE-2023-28101: Flatpak metadata with ANSI control codes can cause misleading terminal output
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the flatpak(1) command-line interface by setting other permissions to crafted values that contain non-printable control characters such as ESC. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-28101?
CVE-2023-28101 is a vulnerability in Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux.
What is the severity of CVE-2023-28101?
The severity of CVE-2023-28101 is medium with a CVSS score of 4.3.
How does CVE-2023-28101 affect Flatpak?
CVE-2023-28101 affects Flatpak versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4.
How can an attacker exploit CVE-2023-28101?
An attacker can exploit CVE-2023-28101 by publishing a Flatpak app with elevated permissions and hiding those permissions from users of the flatpak(1) command-line tool.
Are there any fixes available for CVE-2023-28101?
Yes, the fixes for CVE-2023-28101 are available in Flatpak versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4.