drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Zwei Probleme in flatpak
Name: |
Zwei Probleme in flatpak |
|
ID: |
SUSE-SU-2023:1715-1 |
|
Distribution: |
SUSE |
|
Plattformen: |
openSUSE Leap 15.4, SUSE Manager Proxy 4.3, SUSE Manager Server 4.3, SUSE Manager Retail Branch Server 4.3, SUSE Linux Enterprise Real Time 15 SP4, SUSE Linux Enterprise High Performance Computing 15 SP4, SUSE Linux Enterprise Server 15 SP4, SUSE Linux Enterprise Desktop 15 SP4, SUSE Linux Enterprise Server for SAP Applications 15 SP4, Desktop Applications Module 15-SP4 |
|
Datum: |
Fr, 31. März 2023, 23:07 |
|
Referenzen: |
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28100
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28101 |
|
Applikationen: |
Flatpak |
|
Originalnachricht |
--===============9222857590531711661== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit
# Security update for flatpak
Announcement ID: SUSE-SU-2023:1715-1 Rating: important References:
* #1209410 * #1209411
Cross-References:
* CVE-2023-28100 * CVE-2023-28101
CVSS scores:
* CVE-2023-28100 ( SUSE ): 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H * CVE-2023-28100 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H * CVE-2023-28101 ( SUSE ): 6.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N * CVE-2023-28101 ( NVD ): 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Affected Products:
* Desktop Applications Module 15-SP4 * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3
An update that solves two vulnerabilities can now be installed.
## Description:
This update for flatpak fixes the following issues:
* CVE-2023-28101: Fixed misleading terminal output with metadata with ANSI control codes (bsc#1209410). * CVE-2023-28100: Fixed unsandboxed TIOCLINUX commands (bsc#1209411).
Update to version 1.12.8:
* Update the SELinux module to explicitly permit the system helper have read access to /etc/passwd and systemd-userdbd, read and lock access to /var/lib/flatpak, and watch files inside $libexecdir * If an app update is blocked by parental controls policies, clean up the temporary deploy directory * Fix Autotools build with versions of gpgme that no longer provide gpgme- config(1) * Remove some unreachable code * Add missing handling for some D-Bus errors
Update to version 1.12.7:
* We now allow networked access to X11 and PulseAudio services if that is configured, and the application has network access. * Absolute paths in WAYLAND_DISPLAY now work * Allow apps that were built with Flatpak 1.13.x to export AppStream metadata in share/metainfo * Most commands now work if /var/lib/flatpak exists but
## Patch Instructions:
To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-1715=1
* Desktop Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2023-1715=1
## Package List:
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * flatpak-1.12.8-150400.3.3.1 * typelib-1_0-Flatpak-1_0-1.12.8-150400.3.3.1 * flatpak-debuginfo-1.12.8-150400.3.3.1 * flatpak-devel-1.12.8-150400.3.3.1 * flatpak-zsh-completion-1.12.8-150400.3.3.1 * libflatpak0-1.12.8-150400.3.3.1 * system-user-flatpak-1.12.8-150400.3.3.1 * flatpak-debugsource-1.12.8-150400.3.3.1 * libflatpak0-debuginfo-1.12.8-150400.3.3.1 * Desktop Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) * flatpak-1.12.8-150400.3.3.1 * typelib-1_0-Flatpak-1_0-1.12.8-150400.3.3.1 * flatpak-debuginfo-1.12.8-150400.3.3.1 * flatpak-devel-1.12.8-150400.3.3.1 * flatpak-zsh-completion-1.12.8-150400.3.3.1 * libflatpak0-1.12.8-150400.3.3.1 * system-user-flatpak-1.12.8-150400.3.3.1 * flatpak-debugsource-1.12.8-150400.3.3.1 * libflatpak0-debuginfo-1.12.8-150400.3.3.1
## References:
* https://www.suse.com/security/cve/CVE-2023-28100.html * https://www.suse.com/security/cve/CVE-2023-28101.html * https://bugzilla.suse.com/show_bug.cgi?id=1209410 * https://bugzilla.suse.com/show_bug.cgi?id=1209411
--===============9222857590531711661== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit
<div class="container"> <h1>Security update for flatpak</h1>
<table class="table table-striped table-bordered"> <tbody> <tr> <th>Announcement ID:</th> <td>SUSE-SU-2023:1715-1</td> </tr> <tr> <th>Rating:</th> <td>important</td> </tr> <tr> <th>References:</th> <td> <ul> <li style="display: inline;"> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1209410">#1209410</a> </li> <li style="display: inline;"> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1209411">#1209411</a> </li> </ul> </td> </tr> <tr> <th> Cross-References: </th> <td> <ul> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-28100.html">CVE-2023-28100</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2023-28101.html">CVE-2023-28101</a> </li> </ul> </td> </tr> <tr> <th>CVSS scores:</th> <td> <ul class="list-group"> <li class="list-group-item"> <span class="cvss-reference">CVE-2023-28100</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">8.6</span> <span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2023-28100</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">10.0</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2023-28101</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">6.3</span> <span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2023-28101</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">5.0</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N</span> </li> </ul> </td> </tr> <tr> <th>Affected Products:</th> <td> <ul class="list-group"> <li class="list-group-item">Desktop Applications Module 15-SP4</li> <li class="list-group-item">openSUSE Leap 15.4</li> <li class="list-group-item">SUSE Linux Enterprise Desktop 15 SP4</li> <li class="list-group-item">SUSE Linux Enterprise High Performance Computing 15 SP4</li> <li class="list-group-item">SUSE Linux Enterprise Real Time 15 SP4</li> <li class="list-group-item">SUSE Linux Enterprise Server 15 SP4</li> <li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 15 SP4</li> <li class="list-group-item">SUSE Manager Proxy 4.3</li> <li class="list-group-item">SUSE Manager Retail Branch Server 4.3</li> <li class="list-group-item">SUSE Manager Server 4.3</li> </ul> </td> </tr> </tbody> </table>
<p>An update that solves two vulnerabilities can now be installed.</p>
<h2>Description:</h2> <p>This update for flatpak fixes the following issues:</p> <ul> <li>CVE-2023-28101: Fixed misleading terminal output with metadata with ANSI control codes (bsc#1209410).</li> <li>CVE-2023-28100: Fixed unsandboxed TIOCLINUX commands (bsc#1209411).</li> </ul> <p>Update to version 1.12.8:</p> <ul> <li>Update the SELinux module to explicitly permit the system helper have read access to /etc/passwd and systemd-userdbd, read and lock access to /var/lib/flatpak, and watch files inside $libexecdir</li> <li>If an app update is blocked by parental controls policies, clean up the temporary deploy directory</li> <li>Fix Autotools build with versions of gpgme that no longer provide gpgme-config(1)</li> <li>Remove some unreachable code</li> <li>Add missing handling for some D-Bus errors</li> </ul> <p>Update to version 1.12.7:</p> <ul> <li>We now allow networked access to X11 and PulseAudio services if that is configured, and the application has network access.</li> <li>Absolute paths in WAYLAND_DISPLAY now work</li> <li>Allow apps that were built with Flatpak 1.13.x to export AppStream metadata in share/metainfo</li> <li>Most commands now work if /var/lib/flatpak exists but</li> </ul>
<h2>Patch Instructions:</h2> <p> To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product: </p> <ul class="list-group"> <li class="list-group-item"> openSUSE Leap 15.4 <br/> <code>zypper in -t patch openSUSE-SLE-15.4-2023-1715=1</code> </li> <li class="list-group-item"> Desktop Applications Module 15-SP4 <br/> <code>zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2023-1715=1</code> </li> </ul>
<h2>Package List:</h2> <ul> <li> openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) <ul> <li>flatpak-1.12.8-150400.3.3.1</li> <li>typelib-1_0-Flatpak-1_0-1.12.8-150400.3.3.1</li> <li>flatpak-debuginfo-1.12.8-150400.3.3.1</li> <li>flatpak-devel-1.12.8-150400.3.3.1</li> <li>flatpak-zsh-completion-1.12.8-150400.3.3.1</li> <li>libflatpak0-1.12.8-150400.3.3.1</li> <li>system-user-flatpak-1.12.8-150400.3.3.1</li> <li>flatpak-debugsource-1.12.8-150400.3.3.1</li> <li>libflatpak0-debuginfo-1.12.8-150400.3.3.1</li> </ul> </li> <li> Desktop Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) <ul> <li>flatpak-1.12.8-150400.3.3.1</li> <li>typelib-1_0-Flatpak-1_0-1.12.8-150400.3.3.1</li> <li>flatpak-debuginfo-1.12.8-150400.3.3.1</li> <li>flatpak-devel-1.12.8-150400.3.3.1</li> <li>flatpak-zsh-completion-1.12.8-150400.3.3.1</li> <li>libflatpak0-1.12.8-150400.3.3.1</li> <li>system-user-flatpak-1.12.8-150400.3.3.1</li> <li>flatpak-debugsource-1.12.8-150400.3.3.1</li> <li>libflatpak0-debuginfo-1.12.8-150400.3.3.1</li> </ul> </li> </ul>
<h2>References:</h2> <ul> <li> <a href="https://www.suse.com/security/cve/CVE-2023-28100.html">https://www.suse.com/security/cve/CVE-2023-28100.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2023-28101.html">https://www.suse.com/security/cve/CVE-2023-28101.html</a> </li> <li> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1209410">https://bugzilla.suse.com/show_bug.cgi?id=1209410</a> </li> <li> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1209411">https://bugzilla.suse.com/show_bug.cgi?id=1209411</a> </li> </ul> </div>
--===============9222857590531711661==--
|
|
|
|