OESA-2024-1490

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1490
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2024-1490.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2024-1490
Upstream
Published
2024-04-26T11:07:49Z
Modified
2025-09-03T06:20:15.665697Z
Summary
flatpak security update
Details

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the --command argument of flatpak run expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass bwrap arguments to --command=, such as --bind. It's possible to pass an arbitrary commandline to the portal interface org.freedesktop.portal.Background.RequestBackground from within a Flatpak app. When this is converted into a --command and arguments, it achieves the same effect of passing arguments directly to bwrap, and thus can be used for a sandbox escape. The solution is to pass the -- argument to bwrap, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.(CVE-2024-32462)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP1

flatpak

Package

Name
flatpak
Purl
pkg:rpm/openEuler/flatpak&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0.3-12.oe1

Ecosystem specific 

{
    "aarch64": [
        "flatpak-1.0.3-12.oe1.aarch64.rpm",
        "flatpak-debuginfo-1.0.3-12.oe1.aarch64.rpm",
        "flatpak-devel-1.0.3-12.oe1.aarch64.rpm",
        "flatpak-debugsource-1.0.3-12.oe1.aarch64.rpm"
    ],
    "noarch": [
        "flatpak-help-1.0.3-12.oe1.noarch.rpm"
    ],
    "x86_64": [
        "flatpak-devel-1.0.3-12.oe1.x86_64.rpm",
        "flatpak-debugsource-1.0.3-12.oe1.x86_64.rpm",
        "flatpak-1.0.3-12.oe1.x86_64.rpm",
        "flatpak-debuginfo-1.0.3-12.oe1.x86_64.rpm"
    ],
    "src": [
        "flatpak-1.0.3-12.oe1.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2024-1490.json"

openEuler:20.03-LTS-SP4

flatpak

Package

Name
flatpak
Purl
pkg:rpm/openEuler/flatpak&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0.3-12.oe2003sp4

Ecosystem specific 

{
    "aarch64": [
        "flatpak-1.0.3-12.oe2003sp4.aarch64.rpm",
        "flatpak-devel-1.0.3-12.oe2003sp4.aarch64.rpm",
        "flatpak-debuginfo-1.0.3-12.oe2003sp4.aarch64.rpm",
        "flatpak-debugsource-1.0.3-12.oe2003sp4.aarch64.rpm"
    ],
    "noarch": [
        "flatpak-help-1.0.3-12.oe2003sp4.noarch.rpm"
    ],
    "x86_64": [
        "flatpak-debugsource-1.0.3-12.oe2003sp4.x86_64.rpm",
        "flatpak-devel-1.0.3-12.oe2003sp4.x86_64.rpm",
        "flatpak-1.0.3-12.oe2003sp4.x86_64.rpm",
        "flatpak-debuginfo-1.0.3-12.oe2003sp4.x86_64.rpm"
    ],
    "src": [
        "flatpak-1.0.3-12.oe2003sp4.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2024-1490.json"

openEuler:22.03-LTS

flatpak

Package

Name
flatpak
Purl
pkg:rpm/openEuler/flatpak&distro=openEuler-22.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.10.2-8.oe2203sp3

Ecosystem specific 

{
    "aarch64": [
        "flatpak-debugsource-1.10.2-8.oe2203.aarch64.rpm",
        "flatpak-1.10.2-8.oe2203.aarch64.rpm",
        "flatpak-debuginfo-1.10.2-8.oe2203.aarch64.rpm",
        "flatpak-devel-1.10.2-8.oe2203.aarch64.rpm",
        "flatpak-debugsource-1.10.2-8.oe2203sp1.aarch64.rpm",
        "flatpak-debuginfo-1.10.2-8.oe2203sp1.aarch64.rpm",
        "flatpak-1.10.2-8.oe2203sp1.aarch64.rpm",
        "flatpak-devel-1.10.2-8.oe2203sp1.aarch64.rpm",
        "flatpak-debuginfo-1.10.2-8.oe2203sp2.aarch64.rpm",
        "flatpak-1.10.2-8.oe2203sp2.aarch64.rpm",
        "flatpak-devel-1.10.2-8.oe2203sp2.aarch64.rpm",
        "flatpak-debugsource-1.10.2-8.oe2203sp2.aarch64.rpm",
        "flatpak-devel-1.10.2-8.oe2203sp3.aarch64.rpm",
        "flatpak-debugsource-1.10.2-8.oe2203sp3.aarch64.rpm",
        "flatpak-debuginfo-1.10.2-8.oe2203sp3.aarch64.rpm",
        "flatpak-1.10.2-8.oe2203sp3.aarch64.rpm"
    ],
    "noarch": [
        "flatpak-help-1.10.2-8.oe2203.noarch.rpm",
        "flatpak-help-1.10.2-8.oe2203sp1.noarch.rpm",
        "flatpak-help-1.10.2-8.oe2203sp2.noarch.rpm",
        "flatpak-help-1.10.2-8.oe2203sp3.noarch.rpm"
    ],
    "x86_64": [
        "flatpak-devel-1.10.2-8.oe2203.x86_64.rpm",
        "flatpak-1.10.2-8.oe2203.x86_64.rpm",
        "flatpak-debugsource-1.10.2-8.oe2203.x86_64.rpm",
        "flatpak-debuginfo-1.10.2-8.oe2203.x86_64.rpm",
        "flatpak-debuginfo-1.10.2-8.oe2203sp1.x86_64.rpm",
        "flatpak-devel-1.10.2-8.oe2203sp1.x86_64.rpm",
        "flatpak-debugsource-1.10.2-8.oe2203sp1.x86_64.rpm",
        "flatpak-1.10.2-8.oe2203sp1.x86_64.rpm",
        "flatpak-debugsource-1.10.2-8.oe2203sp2.x86_64.rpm",
        "flatpak-debuginfo-1.10.2-8.oe2203sp2.x86_64.rpm",
        "flatpak-1.10.2-8.oe2203sp2.x86_64.rpm",
        "flatpak-devel-1.10.2-8.oe2203sp2.x86_64.rpm",
        "flatpak-debugsource-1.10.2-8.oe2203sp3.x86_64.rpm",
        "flatpak-1.10.2-8.oe2203sp3.x86_64.rpm",
        "flatpak-devel-1.10.2-8.oe2203sp3.x86_64.rpm",
        "flatpak-debuginfo-1.10.2-8.oe2203sp3.x86_64.rpm"
    ],
    "src": [
        "flatpak-1.10.2-8.oe2203.src.rpm",
        "flatpak-1.10.2-8.oe2203sp1.src.rpm",
        "flatpak-1.10.2-8.oe2203sp2.src.rpm",
        "flatpak-1.10.2-8.oe2203sp3.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2024-1490.json"

openEuler:22.03-LTS-SP1

flatpak

Package

Name
flatpak
Purl
pkg:rpm/openEuler/flatpak&distro=openEuler-22.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.10.2-8.oe2203sp1

Ecosystem specific 

{
    "aarch64": [
        "flatpak-debugsource-1.10.2-8.oe2203sp1.aarch64.rpm",
        "flatpak-debuginfo-1.10.2-8.oe2203sp1.aarch64.rpm",
        "flatpak-1.10.2-8.oe2203sp1.aarch64.rpm",
        "flatpak-devel-1.10.2-8.oe2203sp1.aarch64.rpm"
    ],
    "noarch": [
        "flatpak-help-1.10.2-8.oe2203sp1.noarch.rpm"
    ],
    "x86_64": [
        "flatpak-debuginfo-1.10.2-8.oe2203sp1.x86_64.rpm",
        "flatpak-devel-1.10.2-8.oe2203sp1.x86_64.rpm",
        "flatpak-debugsource-1.10.2-8.oe2203sp1.x86_64.rpm",
        "flatpak-1.10.2-8.oe2203sp1.x86_64.rpm"
    ],
    "src": [
        "flatpak-1.10.2-8.oe2203sp1.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2024-1490.json"

openEuler:22.03-LTS-SP2

flatpak

Package

Name
flatpak
Purl
pkg:rpm/openEuler/flatpak&distro=openEuler-22.03-LTS-SP2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.10.2-8.oe2203sp2

Ecosystem specific 

{
    "aarch64": [
        "flatpak-debuginfo-1.10.2-8.oe2203sp2.aarch64.rpm",
        "flatpak-1.10.2-8.oe2203sp2.aarch64.rpm",
        "flatpak-devel-1.10.2-8.oe2203sp2.aarch64.rpm",
        "flatpak-debugsource-1.10.2-8.oe2203sp2.aarch64.rpm"
    ],
    "noarch": [
        "flatpak-help-1.10.2-8.oe2203sp2.noarch.rpm"
    ],
    "x86_64": [
        "flatpak-debugsource-1.10.2-8.oe2203sp2.x86_64.rpm",
        "flatpak-debuginfo-1.10.2-8.oe2203sp2.x86_64.rpm",
        "flatpak-1.10.2-8.oe2203sp2.x86_64.rpm",
        "flatpak-devel-1.10.2-8.oe2203sp2.x86_64.rpm"
    ],
    "src": [
        "flatpak-1.10.2-8.oe2203sp2.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2024-1490.json"

openEuler:22.03-LTS-SP3

flatpak

Package

Name
flatpak
Purl
pkg:rpm/openEuler/flatpak&distro=openEuler-22.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.10.2-8.oe2203sp3

Ecosystem specific 

{
    "aarch64": [
        "flatpak-devel-1.10.2-8.oe2203sp3.aarch64.rpm",
        "flatpak-debugsource-1.10.2-8.oe2203sp3.aarch64.rpm",
        "flatpak-debuginfo-1.10.2-8.oe2203sp3.aarch64.rpm",
        "flatpak-1.10.2-8.oe2203sp3.aarch64.rpm"
    ],
    "noarch": [
        "flatpak-help-1.10.2-8.oe2203sp3.noarch.rpm"
    ],
    "x86_64": [
        "flatpak-debugsource-1.10.2-8.oe2203sp3.x86_64.rpm",
        "flatpak-1.10.2-8.oe2203sp3.x86_64.rpm",
        "flatpak-devel-1.10.2-8.oe2203sp3.x86_64.rpm",
        "flatpak-debuginfo-1.10.2-8.oe2203sp3.x86_64.rpm"
    ],
    "src": [
        "flatpak-1.10.2-8.oe2203sp3.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2024-1490.json"