This bug was fixed in the package flatpak - 1.8.2-1ubuntu0.1
---------------
flatpak (1.8.2-1ubuntu0.1) groovy-security; urgency=medium
* SECURITY UPDATE: Flatpak sandbox escape via spawn portal (LP: #1911473)
- debian/patches/CVE-2021-21261-1.patch: common: Add a backport of
G_DBUS_METHOD_INVOCATION_HANDLED.
- debian/patches/CVE-2021-21261-2.patch: run: Convert all environment
variables into bwrap arguments.
- debian/patches/CVE-2021-21261-3.patch: tests: Expand coverage for
environment variable overrides.
- debian/patches/CVE-2021-21261-4.patch: context: Add --env-fd option.
- debian/patches/CVE-2021-21261-5.patch: portal: Convert --env in
extra-args into --env-fd.
- debian/patches/CVE-2021-21261-6.patch: tests: Exercise --env-fd.
- debian/patches/CVE-2021-21261-7.patch: portal: Do not use
caller-supplied variables in environment.
- debian/patches/CVE-2021-21261-8.patch: tests: Assert that --env= does
not go in `flatpak run` or bwrap environ.
- CVE-2021-21261
-- Andrew Hayzen <[email protected]> Fri, 22 Jan 2021 00:59:12 +0000
** Changed in: flatpak (Ubuntu Groovy)
Status: In Progress => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1911473
Title:
Update for ghsa-4ppf-fxf6-vxg2
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/flatpak/+bug/1911473/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
