REDHAT-BUG-2539423: Low severity Flatpak Flatpak vulnerability
GHSA-2fxp-43j9-pwvc (https://github.com/flatpak/flatpak/security/advisories/GHSA-2fxp-43j9-pwvc)
Description: The OCI code paths in the system helper will follow symlinks when importing OCI images which are under the user's control, allowing a malicious user to get read-access to files in the system-helper context if a system OCI repository is configured.
Mitigation: Remove all OCI system remotes. Patched in 1.16.4 and 1.18.0. Credit: @smcv.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
flatpakto a version that resolves this vulnerability.Fixed in 1.16.4 - Upgrade
Upgrade
flatpakto a version that resolves this vulnerability.Fixed in 1.18.0 - Compensating control
Remove all OCI system remotes.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Systems are exposed if they have an OCI system remote configured and allow a malicious user to control OCI images imported through the system helper.
What does an attacker need to exploit it?
An attacker needs control over an OCI image that is imported through the affected system-helper OCI code path. The issue relies on symlinks in that image being followed during import.
What could exploitation allow?
A malicious user could gain read access to files accessible in the system-helper context.
What can be done if updating is not immediately possible?
Remove all OCI system remotes to mitigate the issue.
Which versions contain fixes?
The issue is patched in Flatpak 1.16.4 and 1.18.0.