正文

Flatpak 注入漏洞

admin
admin V管理员 /0 评论 /9 阅读
0305
此篇文章发布距今已超过1219天，您需要注意文章的内容或图片是否可用！

漏洞信息详情

Flatpak 注入漏洞

  • CNNVD编号：CNNVD-202101-1138
    • <!--
  • 危害等级： 高危-->
  • 危害等级： 高危
  • CVE编号： CVE-2021-21261
  • 漏洞类型： 注入
  • 发布时间： 2021-01-14
  • 威胁类型： 本地
  • 更新时间： 2021-04-09
  • 厂        商：
  • 漏洞来源： Gentoo

漏洞简介

Flatpak是一套用于Linux桌面应用计算机环境的应用程序虚拟化系统。

Flatpak 存在注入漏洞，该漏洞源于flatpak-portal允许沙箱应用程序在主机系统上执行任意代码(沙箱逃脱)。

漏洞公告

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://github.com/flatpak/flatpak/commit/fb1eaefbceeb73f02eb1bc85865d74a414faf8b8

参考网址

来源:DEBIAN

链接:https://www.debian.org/security/2021/dsa-4830

来源:MISC

链接:https://github.com/flatpak/flatpak/commit/6a11007021658518c088ba0cc5e4da27962a940a

来源:MISC

链接:https://github.com/flatpak/flatpak/commit/57416f380600d9754df12baf5b227144ff1bb54d

来源:MISC

链接:https://github.com/flatpak/flatpak/releases/tag/1.8.5

来源:MISC

链接:https://github.com/flatpak/flatpak/commit/cc1401043c075268ecc652eac557ef8076b5eaba

来源:MISC

链接:https://github.com/flatpak/flatpak/commit/6d1773d2a54dde9b099043f07a2094a4f1c2f486

来源:GENTOO

链接:https://security.gentoo.org/glsa/202101-21

来源:MISC

链接:https://github.com/flatpak/flatpak/commit/aeb6a7ab0abaac4a8f4ad98b3df476d9de6b8bd4

来源:MISC

链接:https://github.com/flatpak/flatpak/commit/dcd24941c7087c5f7e8033abe50b178ac02a34af

来源:MISC

链接:https://github.com/flatpak/flatpak/commit/fb1eaefbceeb73f02eb1bc85865d74a414faf8b8

来源:CONFIRM

链接:https://github.com/flatpak/flatpak/security/advisories/GHSA-4ppf-fxf6-vxg2

来源:MISC

链接:https://github.com/flatpak/flatpak/commit/6e5ae7a109cdfa9735ea7ccbd8cb79f9e8d3ae8b

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.1186

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/161093/Gentoo-Linux-Security-Advisory-202101-21.html

来源:vigilance.fr

链接:https://vigilance.fr/vulnerability/Flatpak-code-execution-via-flatpak-portal-34445

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.0341/

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/161212/Red-Hat-Security-Advisory-2021-0307-01.html

来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2021-21261

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/161289/Ubuntu-Security-Notice-USN-4721-1.html

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.0416

受影响实体

    暂无


补丁

  • Flatpak 注入漏洞的修复措施
    <!--
    2021-1-14
    -->