Debian dsa-5666 : flatpak - security update

high Nessus Plugin ID 193600

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5666 advisory.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

- ------------------------------------------------------------------------- Debian Security Advisory DSA-5666-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 19, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : flatpak CVE ID : CVE-2024-32462

Gergo Koteles discovered that sandbox restrictions in Flatpak, an application deployment framework for desktop apps, could by bypassed in combination with xdg-desktop-portal.

For the oldstable distribution (bullseye), this problem has been fixed in version 1.10.8-0+deb11u2.

For the stable distribution (bookworm), this problem has been fixed in version 1.14.4-1+deb12u1.

We recommend that you upgrade your flatpak packages.

For the detailed security status of flatpak please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/flatpak

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Mailing list: [email protected]
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmYirHgACgkQEMKTtsN8 TjZ/fw/9HJrZuS4dqi625mS1MsYCcYWOUnpq/9PeEHBovQjGaygh48cfY6JcPaTt yl+IhIzJHIPakCQZtUfl8SdAvWEjMYxoXgd4caBsJ7FGw4Z29ZeEfr1850/RD5Do u4kviFrtAmPm1mfUYqo/fzMIZxeNqLY3inYygfTp4/WCqS7uLsiLAsrhNZua2mwc UKnTbax8+na6YhUyOWLhh5r6aOoIdg831gEtyj1ZN4/4HUU2iPA8V2gebmEt+Z9W PFDh2GqRegExaKqg9HaZd9Olr9kjvRBHs3Kt4gUF97e6hcoxf1MlM06SDgc2rPhq it3kOgI+BdYGSyY/1oGBS4otW+1jjz+/48TXuvkkR82hnoLcDW6yGGMVxNx76W/g P/m93+A1dh6HdFq3JgMjqOivM7A+HU+5UpFyC+yyk0bfS8umwl7aXdmllabCkcs1 7/0Mhoc7u+OxaNoSK/EHwVT28th7X0pKbvQFEhqTP8dHAgwKe2Pdy7kVkptuX9cL wuuOgyDNHyyAaJzdtmpAmWrEk+7amqjq3YT2uPPwFcvOVa7OHBz6VIHeQ3gv8JSh VyR0OYWWEqgGgCQUZkgvVKvGsT7Oxd68Dmgb3dIHqAL9HIFLoFybZno6tj20rkqk coiKnCuLaqig3M0NoizxJVTbOZ7/kY96wRM8HPtkGL7G/cgsZ3o= =VYOY
-----END PGP SIGNATURE-----

Reply to:
[email protected] Moritz Muehlenhoff (on-list) Moritz Muehlenhoff (off-list)

Prev by Date:
[SECURITY] [DSA 5665-1] tomcat10 security update

Next by Date:
[SECURITY] [DSA 5667-1] tomcat9 security update

Previous by thread:
[SECURITY] [DSA 5665-1] tomcat10 security update

Next by thread:
[SECURITY] [DSA 5667-1] tomcat9 security update

Index(es):

Date Thread

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade the flatpak packages.

Plugin Details

Severity: High

ID: 193600

File Name: debian_DSA-5666.nasl

Version: 1.1

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 4/19/2024

Updated: 1/24/2025

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-32462

CVSS v3

Risk Factor: High

Base Score: 8.4

Temporal Score: 7.3

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:flatpak-tests, p-cpe:/a:debian:debian_linux:flatpak, p-cpe:/a:debian:debian_linux:libflatpak0, p-cpe:/a:debian:debian_linux:libflatpak-doc, p-cpe:/a:debian:debian_linux:gir1.2-flatpak-1.0, cpe:/o:debian:debian_linux:12.0, p-cpe:/a:debian:debian_linux:libflatpak-dev

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 4/19/2024

Vulnerability Publication Date: 4/18/2024

Reference Information

CVE: CVE-2024-32462

Detections

Analytics