CVE-2023-28101mediumCWE-116

CVE-2023-28101: falha de média gravidade em flatpak

Flatpak metadata with ANSI control codes can cause misleading terminal output

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar flatpak+ Monitorar flatpak

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5epss 0.9%
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Produtos afetados
flatpak · flatpak
CVEs relacionadas — flatpak

No mesmo produto, das mais perigosas para as menos.

CVE-2022-21682HIGHflatpak-builder can access files outside the build directory.EPSS 1.8%CVE-2026-34078CRITICALFlatpak has a complete sandbox escape leading to host file access and code execution in the host contextEPSS 1.7%CVE-2021-21381HIGHSandbox escape via special tokens in .desktop fileEPSS 1.5%CVE-2021-43860HIGHPermissions granted to applications can be hidden from the user at install timeEPSS 1.4%CVE-2024-42472CRITICALFlatpak may allow access to files outside sandbox for certain appsEPSS 1.3%CVE-2023-28100CRITICALTIOCLINUX can send commands outside sandbox if running on a virtual consoleEPSS 0.9%