Red Hat Security Advisory

RHSA-2019:1024

flatpak security update

Released 2019-05-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) flatpak-1.0.2-5.el7_6, flatpak-libs-1.0.2-5.el7_6
Red Hat Enterprise Linux Client Optional (v. 7) flatpak-builder-1.0.0-5.el7_6, flatpak-devel-1.0.2-5.el7_6
Red Hat Enterprise Linux ComputeNode Optional (v. 7) flatpak-1.0.2-5.el7_6, flatpak-builder-1.0.0-5.el7_6, flatpak-devel-1.0.2-5.el7_6 +1
Red Hat Enterprise Linux Server (v. 7) flatpak-1.0.2-5.el7_6, flatpak-libs-1.0.2-5.el7_6
Red Hat Enterprise Linux Server Optional (v. 7) flatpak-builder-1.0.0-5.el7_6, flatpak-devel-1.0.2-5.el7_6
Red Hat Enterprise Linux Workstation (v. 7) flatpak-1.0.2-5.el7_6, flatpak-libs-1.0.2-5.el7_6
Red Hat Enterprise Linux Workstation Optional (v. 7) flatpak-builder-1.0.0-5.el7_6, flatpak-devel-1.0.2-5.el7_6
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) flatpak-1.0.2-5.el7_6, flatpak-libs-1.0.2-5.el7_6
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) flatpak-builder-1.0.0-5.el7_6, flatpak-devel-1.0.2-5.el7_6

TI-2019-07389 CVE-2019-10063 · GHSA-mc9j-733x-89cx

MEDIUM 43

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass.

CVSS 3.0CRITICAL 9.0 Network No auth No interaction EPSS 0.01909 Published 2019-03-26 Fixed CWE-20