REDHAT-BUG-2537014: Low severity xdg-dbus-proxy vulnerability
A flaw was found in xdg-dbus-proxy. The filtering logic applied to D-Bus broadcast messages does not correctly enforce the configured path, interface, and member restrictions. As a result, a malicious or compromised Flatpak application can intercept broadcast signals on the D-Bus session bus and the AT-SPI bus that should have been filtered out, potentially exposing information from other applications on the bus to an unauthorized sandboxed application.
Upstream advisory: https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-r7hp-698j-2h6c Affected versions: 0.1.6, 0.1.7 Fixed version: 0.1.8 Upstream CVSS: 3.2 (Low)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
xdg-dbus-proxyto a version that resolves this vulnerability.Fixed in 0.1.8Patch GHSA-r7hp-698j-2h6c
Event History
Frequently Asked Questions
Which installations are affected?
xdg-dbus-proxy versions 0.1.6 and 0.1.7 are affected. Version 0.1.8 is identified as the fixed version.
What must an attacker be able to do to exploit this issue?
An attacker needs to control a malicious or compromised Flatpak application. The application can then intercept D-Bus broadcast signals on the session bus and AT-SPI bus despite configured filtering restrictions.
What information could be exposed?
Broadcast signals from other applications on the D-Bus session bus or AT-SPI bus may be exposed to an unauthorized sandboxed Flatpak application. The issue concerns signals that should have been excluded by path, interface, or member filtering rules.
What should be done to remediate the issue?
Update xdg-dbus-proxy to version 0.1.8 or later. This version is listed as fixing the broadcast-message filtering flaw.