(RHSA-2024:6356) Important: bubblewrap and flatpak security update

2024-09-0418:07:05

access.redhat.com

bubblewrap

flatpak

security update

unprivileged containers

setuid binary

persistent access

cve-2024-42472

cvss score

references section

unix

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

9.7

Confidence

High

JSON

Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.

Security Fix(es):

flatpak: Access to files outside sandbox for apps using persistent= (–persist) (CVE-2024-42472)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
RedHat9x86_64bubblewrap< 0.4.1-7.el9_4bubblewrap-0.4.1-7.el9_4.x86_64.rpm
RedHat9aarch64flatpak-session-helper< 1.12.9-3.el9_4flatpak-session-helper-1.12.9-3.el9_4.aarch64.rpm
RedHat9x86_64flatpak-debugsource< 1.12.9-3.el9_4flatpak-debugsource-1.12.9-3.el9_4.x86_64.rpm
RedHat9ppc64leflatpak-libs-debuginfo< 1.12.9-3.el9_4flatpak-libs-debuginfo-1.12.9-3.el9_4.ppc64le.rpm
RedHat9s390xflatpak-debuginfo< 1.12.9-3.el9_4flatpak-debuginfo-1.12.9-3.el9_4.s390x.rpm
RedHat9s390xflatpak-libs< 1.12.9-3.el9_4flatpak-libs-1.12.9-3.el9_4.s390x.rpm
RedHat9s390xbubblewrap-debugsource< 0.4.1-7.el9_4bubblewrap-debugsource-0.4.1-7.el9_4.s390x.rpm
RedHat9x86_64flatpak-session-helper-debuginfo< 1.12.9-3.el9_4flatpak-session-helper-debuginfo-1.12.9-3.el9_4.x86_64.rpm
RedHat9aarch64bubblewrap< 0.4.1-7.el9_4bubblewrap-0.4.1-7.el9_4.aarch64.rpm
RedHat9ppc64lebubblewrap-debuginfo< 0.4.1-7.el9_4bubblewrap-debuginfo-0.4.1-7.el9_4.ppc64le.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	9	x86_64	bubblewrap	< 0.4.1-7.el9_4	bubblewrap-0.4.1-7.el9_4.x86_64.rpm
RedHat	9	aarch64	flatpak-session-helper	< 1.12.9-3.el9_4	flatpak-session-helper-1.12.9-3.el9_4.aarch64.rpm
RedHat	9	x86_64	flatpak-debugsource	< 1.12.9-3.el9_4	flatpak-debugsource-1.12.9-3.el9_4.x86_64.rpm
RedHat	9	ppc64le	flatpak-libs-debuginfo	< 1.12.9-3.el9_4	flatpak-libs-debuginfo-1.12.9-3.el9_4.ppc64le.rpm
RedHat	9	s390x	flatpak-debuginfo	< 1.12.9-3.el9_4	flatpak-debuginfo-1.12.9-3.el9_4.s390x.rpm
RedHat	9	s390x	flatpak-libs	< 1.12.9-3.el9_4	flatpak-libs-1.12.9-3.el9_4.s390x.rpm
RedHat	9	s390x	bubblewrap-debugsource	< 0.4.1-7.el9_4	bubblewrap-debugsource-0.4.1-7.el9_4.s390x.rpm
RedHat	9	x86_64	flatpak-session-helper-debuginfo	< 1.12.9-3.el9_4	flatpak-session-helper-debuginfo-1.12.9-3.el9_4.x86_64.rpm
RedHat	9	aarch64	bubblewrap	< 0.4.1-7.el9_4	bubblewrap-0.4.1-7.el9_4.aarch64.rpm
RedHat	9	ppc64le	bubblewrap-debuginfo	< 0.4.1-7.el9_4	bubblewrap-debuginfo-0.4.1-7.el9_4.ppc64le.rpm