Synopsis

Important: flatpak security update

Type/Severity

Security Advisory: Important

Topic

An update for flatpak is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226) (CVE-2019-10063)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

• BZ - 1695973 - CVE-2019-10063 flatpak: Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226)

CVEs

• CVE-2019-10063

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux for x86_64 8

SRPM
flatpak-1.0.6-3.el8_0.src.rpm	SHA-256: c2035aeca5b64d138d071c9bcf990ca20f81a9a20f136b7be71cc3298ff2e289
x86_64
flatpak-1.0.6-3.el8_0.x86_64.rpm	SHA-256: 14eee22067d0c0f2ffcdb88f7b82b28f0c0f20bcc8f7a896f5fdad82fd57dc0c
flatpak-debuginfo-1.0.6-3.el8_0.i686.rpm	SHA-256: 4c24dc1d81c4816580d7a13205a61e92557325044124b328bc98432e5cf8241a
flatpak-debuginfo-1.0.6-3.el8_0.x86_64.rpm	SHA-256: 1a8e3f06696ac8e8919e7969a84c4ea8be7b25345a82af1b3bb8aec729f7389b
flatpak-debugsource-1.0.6-3.el8_0.i686.rpm	SHA-256: d22655e926a37c445138fa08595d27c8cfbab1dd2300b3f0380d0176b0ae10ad
flatpak-debugsource-1.0.6-3.el8_0.x86_64.rpm	SHA-256: d94726c133a04fad3f09ed842de8a734d9f52dc9a4f84e6d582e68280b06e986
flatpak-libs-1.0.6-3.el8_0.i686.rpm	SHA-256: 2c1da90d5e77d44c4bba85b9ed2ad8d1547c45da1a16a43948f90bad30445985
flatpak-libs-1.0.6-3.el8_0.x86_64.rpm	SHA-256: 516aa3d3ca9a7acb50e99041a628a2e8e266295eea5e548e2b10967157ab96ff
flatpak-libs-debuginfo-1.0.6-3.el8_0.i686.rpm	SHA-256: 558eafc89ccc5bb42b925f8d7a80cba2c58fca7bcd95523e624c696ae38200d7
flatpak-libs-debuginfo-1.0.6-3.el8_0.x86_64.rpm	SHA-256: 8e93cc7e60d2888c17209807953f3ffec61e9e91e131df714942ee4e4759542c

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
flatpak-1.0.6-3.el8_0.src.rpm	SHA-256: c2035aeca5b64d138d071c9bcf990ca20f81a9a20f136b7be71cc3298ff2e289
s390x
flatpak-1.0.6-3.el8_0.s390x.rpm	SHA-256: e70e4779303a300ca878928feefb28a4f3963bc017868ab1d895a85fbe76d0f1
flatpak-debuginfo-1.0.6-3.el8_0.s390x.rpm	SHA-256: 2d1009103b35bc091d9bb0785a2177c105a5ff5113f9425dfed65e116f350ccf
flatpak-debugsource-1.0.6-3.el8_0.s390x.rpm	SHA-256: c5966c50cbec794949efaf9fbf25e32fcc41eb0f40ede497c1df38f4afe920ff
flatpak-libs-1.0.6-3.el8_0.s390x.rpm	SHA-256: 4fb9f4e51f2d866e1fdac52e0ae5e8d04c07c695d29aecf4b8613dc653ba5a69
flatpak-libs-debuginfo-1.0.6-3.el8_0.s390x.rpm	SHA-256: efc84ebd981d88ead6217a58db460decb680485bc75ce1076fb897ccd3a75512

Red Hat Enterprise Linux for Power, little endian 8

SRPM
flatpak-1.0.6-3.el8_0.src.rpm	SHA-256: c2035aeca5b64d138d071c9bcf990ca20f81a9a20f136b7be71cc3298ff2e289
ppc64le
flatpak-1.0.6-3.el8_0.ppc64le.rpm	SHA-256: 0740ce98f1ed228deefd6a7c1133c62e9540468dce8495ffe99b80c0ea4da615
flatpak-debuginfo-1.0.6-3.el8_0.ppc64le.rpm	SHA-256: 0d22e99ce46db9e40db39c8a3dfb27ad347bc2a80fb9c76d84a2d4e68cb3b67a
flatpak-debugsource-1.0.6-3.el8_0.ppc64le.rpm	SHA-256: 17452901aa9c70956585c42a52f24d038146e5e6ad22f23088b371753a28be04
flatpak-libs-1.0.6-3.el8_0.ppc64le.rpm	SHA-256: 4120cce13e7f1e4295127d98d8c46d344902edf71604287ef292db1ac06d9cb5
flatpak-libs-debuginfo-1.0.6-3.el8_0.ppc64le.rpm	SHA-256: 95e2dfea07c5cb10924d279eef28eafada80b7c35a20c3332ca2976be22ca925

Red Hat Enterprise Linux for ARM 64 8

SRPM
flatpak-1.0.6-3.el8_0.src.rpm	SHA-256: c2035aeca5b64d138d071c9bcf990ca20f81a9a20f136b7be71cc3298ff2e289
aarch64
flatpak-1.0.6-3.el8_0.aarch64.rpm	SHA-256: 4caeb015f1a6236d8bf9e5e5f6cc7f6508a7ada50e1a080594044ab73a7f4828
flatpak-debuginfo-1.0.6-3.el8_0.aarch64.rpm	SHA-256: 1193498da537685381e65cd7daf4e3afb95f004ff6d59d3f3382729e59af1b9b
flatpak-debugsource-1.0.6-3.el8_0.aarch64.rpm	SHA-256: 3d04d98038b3dc4ce8ae143b99482a71532d95b2d578c3bbb441ba71ac9801a8
flatpak-libs-1.0.6-3.el8_0.aarch64.rpm	SHA-256: 7c90d72d3c1217298625b7c84299ce82cff51a0c0b62090c0267576e4d36c0fc
flatpak-libs-debuginfo-1.0.6-3.el8_0.aarch64.rpm	SHA-256: d03721dbcd7606fb0a245a705df07fdcf450dcaf99c4e604e1929821d181a21a