Red Hat Product Errata RHSA-2023:7038 - Security Advisory
Issued:
2023-11-14
Updated:
2023-11-14

RHSA-2023:7038 - Security Advisory

Synopsis

Moderate: flatpak security, bug fix, and enhancement update

Type/Severity

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for flatpak is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

The following packages have been upgraded to a later upstream version: flatpak (1.10.8). (BZ#2222103)

Security Fix(es):

  • flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console (CVE-2023-28100)
  • flatpak: Metadata with ANSI control codes can cause misleading terminal output (CVE-2023-28101)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 8 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x

Fixes

  • BZ - 2179219 - CVE-2023-28101 flatpak: Metadata with ANSI control codes can cause misleading terminal output
  • BZ - 2179220 - CVE-2023-28100 flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console
  • BZ - 2222103 - Update flatpak to 1.10.8

Red Hat Enterprise Linux for x86_64 8

SRPM
flatpak-1.10.8-1.el8.src.rpm SHA-256: cd51753e020b7ada414647848c5da0f999a136335e4ee68af011ffd4a5bfb814
x86_64
flatpak-1.10.8-1.el8.x86_64.rpm SHA-256: 04cce4b6cb28defe0ff803136806d7f522bdb0f21ccc4c57479e8081647bd3a9
flatpak-debuginfo-1.10.8-1.el8.i686.rpm SHA-256: 7b6ea91869a1166c2bd9fe9910e017d1bb8742d60130d19195150936e947d41f
flatpak-debuginfo-1.10.8-1.el8.x86_64.rpm SHA-256: a6289248dea2f8041be9b672e352417f2116857a39a52c614c2e703360b4f5f2
flatpak-debugsource-1.10.8-1.el8.i686.rpm SHA-256: 9a2b94db94d3efeeafff72c644cb956d36c202a229c3fce83373c3d3ddb9f842
flatpak-debugsource-1.10.8-1.el8.x86_64.rpm SHA-256: 15d578b10a9d3ba650c9cc049bba49731539b6d1bb6802fbabc0356309497e92
flatpak-libs-1.10.8-1.el8.i686.rpm SHA-256: f64b0d568c4962061bebe98bcf71197831e67915584c4587ddec528a3ed4d4bd
flatpak-libs-1.10.8-1.el8.x86_64.rpm SHA-256: f34e91633fca7a6a4e5805bbe2c96c65993f87dc4232800fc15f833befc7faf3
flatpak-libs-debuginfo-1.10.8-1.el8.i686.rpm SHA-256: f9f33f85f08f8a7bc3a12413ed21a049af6dd9a6ac19469bc83f4b2fbc689169
flatpak-libs-debuginfo-1.10.8-1.el8.x86_64.rpm SHA-256: 9ea2e2cd3b8651c915d045f4cda9d3820c2bebf5d22a395a42009a3235dc9e66
flatpak-selinux-1.10.8-1.el8.noarch.rpm SHA-256: 8ea3d6a075074dd0f8d7eac454304742a52817bf3cd98e7ed10997d26e64ae61
flatpak-session-helper-1.10.8-1.el8.x86_64.rpm SHA-256: 2e0ec09ed95dc918fbc3d31f59871f098aeef9fdc86f8974c551ab681513207f
flatpak-session-helper-debuginfo-1.10.8-1.el8.i686.rpm SHA-256: e3d631cbfdab1a045b05d438b38d69adbce38620dc17c8e31e4fffdd716420f3
flatpak-session-helper-debuginfo-1.10.8-1.el8.x86_64.rpm SHA-256: db6c09fc3565819251fab744fb7100c439e414e32e2db62c248ee1b636239530
flatpak-tests-debuginfo-1.10.8-1.el8.i686.rpm SHA-256: 993e18748deee6a484277a9cf7c187d4a194a932f1def39f0989bc37f14e39e4
flatpak-tests-debuginfo-1.10.8-1.el8.x86_64.rpm SHA-256: 4a17b88d6d37167520d31cc1566269f42b91691073eedcd6f2dc296e8d154af0

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
flatpak-1.10.8-1.el8.src.rpm SHA-256: cd51753e020b7ada414647848c5da0f999a136335e4ee68af011ffd4a5bfb814
s390x
flatpak-1.10.8-1.el8.s390x.rpm SHA-256: 7796b943aafd02be10a7ccd3bd85a1aa846b70d736040a545b9a1a7f9ca26e4a
flatpak-debuginfo-1.10.8-1.el8.s390x.rpm SHA-256: 388841e86f16e2ca1b30e000401c2d2a2f6f98ef8d2d23323a48ef8551a435a7
flatpak-debugsource-1.10.8-1.el8.s390x.rpm SHA-256: 6730dfcd322d428e579f059635ebc6f30541daf4f6edc2bdd995582017ec5c56
flatpak-libs-1.10.8-1.el8.s390x.rpm SHA-256: 64a7d29e6cc5a20ddf4ac51ff2ebd6e1df1bdc457334c517d99ea7f50884d5a6
flatpak-libs-debuginfo-1.10.8-1.el8.s390x.rpm SHA-256: aa90aecb3d48543ddd61c2bb85fe37949b63bc5758c5ec8b9d48293b1b5a0c4a
flatpak-selinux-1.10.8-1.el8.noarch.rpm SHA-256: 8ea3d6a075074dd0f8d7eac454304742a52817bf3cd98e7ed10997d26e64ae61
flatpak-session-helper-1.10.8-1.el8.s390x.rpm SHA-256: 3a67e547104eaf865d71c167c4a382996539a63419477cad9400f4b1fa943e2d
flatpak-session-helper-debuginfo-1.10.8-1.el8.s390x.rpm SHA-256: a2d67ab446a4b7cb001c7bca8b7383efbad8b4752b78fdbdcefb8054966ed595
flatpak-tests-debuginfo-1.10.8-1.el8.s390x.rpm SHA-256: 718f4bb809b4557428cf42641ede5f141ffb14e0561a9f1627b85c75881905a4

Red Hat Enterprise Linux for Power, little endian 8

SRPM
flatpak-1.10.8-1.el8.src.rpm SHA-256: cd51753e020b7ada414647848c5da0f999a136335e4ee68af011ffd4a5bfb814
ppc64le
flatpak-1.10.8-1.el8.ppc64le.rpm SHA-256: a3a435354e25d2f89bb8df3c8b2f55144c96c32a7edde036ed6f87deb98fc069
flatpak-debuginfo-1.10.8-1.el8.ppc64le.rpm SHA-256: 1e1dd0a796b181092c20d8d0152384c4fa68ef6075836d3bc5c896d5e1e7938a
flatpak-debugsource-1.10.8-1.el8.ppc64le.rpm SHA-256: 4cbdb35f96369f5269e5ab54b64a81c4999477e52ba6a8ef84e14781d34362fb
flatpak-libs-1.10.8-1.el8.ppc64le.rpm SHA-256: 5e6ef2177c3ed052a3f4925faaf8ca3df0fc39d92b25f5ac1eefff8e18d6ad06
flatpak-libs-debuginfo-1.10.8-1.el8.ppc64le.rpm SHA-256: d28376e3e1410c91f30649f9d4bd65e86a3181298c2772af91ade4fb0e080093
flatpak-selinux-1.10.8-1.el8.noarch.rpm SHA-256: 8ea3d6a075074dd0f8d7eac454304742a52817bf3cd98e7ed10997d26e64ae61
flatpak-session-helper-1.10.8-1.el8.ppc64le.rpm SHA-256: 1fa8deaf12d31720b165938160b1ee884d99fde783b30d93287e76fb031a9b7f
flatpak-session-helper-debuginfo-1.10.8-1.el8.ppc64le.rpm SHA-256: 9004091ebc849a81617eae524a1ca1891874bcd2224449c2bc1e80981618074e
flatpak-tests-debuginfo-1.10.8-1.el8.ppc64le.rpm SHA-256: 6ea008099f419b0857bae8a5f866241984556e85238d96e136d44226e39a42d7

Red Hat Enterprise Linux for ARM 64 8

SRPM
flatpak-1.10.8-1.el8.src.rpm SHA-256: cd51753e020b7ada414647848c5da0f999a136335e4ee68af011ffd4a5bfb814
aarch64
flatpak-1.10.8-1.el8.aarch64.rpm SHA-256: e85df1bfebdaf7fe37f3ec8204a6238cb241cd27aacaa17178adbb87c2764bc8
flatpak-debuginfo-1.10.8-1.el8.aarch64.rpm SHA-256: 2616cc28fab757013b797459dd256c7fede9670f6123ccddea3bb380a423c110
flatpak-debugsource-1.10.8-1.el8.aarch64.rpm SHA-256: 261b821ee40518fe032fd32b3c37913ba7f6e31e85f620002b327423a8743317
flatpak-libs-1.10.8-1.el8.aarch64.rpm SHA-256: b42f85ae4ee84e1eacba8ab2ddaf45fcda2f7f3138202380d6ac119c1bee11da
flatpak-libs-debuginfo-1.10.8-1.el8.aarch64.rpm SHA-256: 417e9b57b758498b29b699e230c336fb704cfef39e26576d6e629e6ba83081bb
flatpak-selinux-1.10.8-1.el8.noarch.rpm SHA-256: 8ea3d6a075074dd0f8d7eac454304742a52817bf3cd98e7ed10997d26e64ae61
flatpak-session-helper-1.10.8-1.el8.aarch64.rpm SHA-256: 6ad63ef99974ace8d5983f044f695d605c6528060d0488a96dac6d1d4327b2b7
flatpak-session-helper-debuginfo-1.10.8-1.el8.aarch64.rpm SHA-256: 8658fa776f98884d8d565bbab5b676521ee63862d8bc51df81a75df7b2e4a51d
flatpak-tests-debuginfo-1.10.8-1.el8.aarch64.rpm SHA-256: 746a8becca356adeefbc51cdd26659f23dd307c09d5c24b2853334364c132c23

Red Hat CodeReady Linux Builder for x86_64 8

SRPM
x86_64
flatpak-1.10.8-1.el8.i686.rpm SHA-256: 28fed438e41a668b22413fa949b01f956eda45575a5ffaba9af21fb42edc2d1c
flatpak-debuginfo-1.10.8-1.el8.i686.rpm SHA-256: 7b6ea91869a1166c2bd9fe9910e017d1bb8742d60130d19195150936e947d41f
flatpak-debuginfo-1.10.8-1.el8.x86_64.rpm SHA-256: a6289248dea2f8041be9b672e352417f2116857a39a52c614c2e703360b4f5f2
flatpak-debugsource-1.10.8-1.el8.i686.rpm SHA-256: 9a2b94db94d3efeeafff72c644cb956d36c202a229c3fce83373c3d3ddb9f842
flatpak-debugsource-1.10.8-1.el8.x86_64.rpm SHA-256: 15d578b10a9d3ba650c9cc049bba49731539b6d1bb6802fbabc0356309497e92
flatpak-devel-1.10.8-1.el8.i686.rpm SHA-256: 7538bdaa85646064ac35ca6900fa54bd748b2c945fae18d95ee308bff8000b7d
flatpak-devel-1.10.8-1.el8.x86_64.rpm SHA-256: 35fbb4a520e67a21ab3dec3760e90c7763e719b38d884186e3c7004e0e46e1b6
flatpak-libs-debuginfo-1.10.8-1.el8.i686.rpm SHA-256: f9f33f85f08f8a7bc3a12413ed21a049af6dd9a6ac19469bc83f4b2fbc689169
flatpak-libs-debuginfo-1.10.8-1.el8.x86_64.rpm SHA-256: 9ea2e2cd3b8651c915d045f4cda9d3820c2bebf5d22a395a42009a3235dc9e66
flatpak-session-helper-1.10.8-1.el8.i686.rpm SHA-256: cbb9f3128a45443d1c645e552b52874bfe9e6700a42d69dd1a9f11a15ec5ebbc
flatpak-session-helper-debuginfo-1.10.8-1.el8.i686.rpm SHA-256: e3d631cbfdab1a045b05d438b38d69adbce38620dc17c8e31e4fffdd716420f3
flatpak-session-helper-debuginfo-1.10.8-1.el8.x86_64.rpm SHA-256: db6c09fc3565819251fab744fb7100c439e414e32e2db62c248ee1b636239530
flatpak-tests-debuginfo-1.10.8-1.el8.i686.rpm SHA-256: 993e18748deee6a484277a9cf7c187d4a194a932f1def39f0989bc37f14e39e4
flatpak-tests-debuginfo-1.10.8-1.el8.x86_64.rpm SHA-256: 4a17b88d6d37167520d31cc1566269f42b91691073eedcd6f2dc296e8d154af0

Red Hat CodeReady Linux Builder for Power, little endian 8

SRPM
ppc64le
flatpak-debuginfo-1.10.8-1.el8.ppc64le.rpm SHA-256: 1e1dd0a796b181092c20d8d0152384c4fa68ef6075836d3bc5c896d5e1e7938a
flatpak-debugsource-1.10.8-1.el8.ppc64le.rpm SHA-256: 4cbdb35f96369f5269e5ab54b64a81c4999477e52ba6a8ef84e14781d34362fb
flatpak-devel-1.10.8-1.el8.ppc64le.rpm SHA-256: 76f2457e219baf87c7dc4e7a9ffb1d07cbf467b62185ff42d2241d7bbcd66ed0
flatpak-libs-debuginfo-1.10.8-1.el8.ppc64le.rpm SHA-256: d28376e3e1410c91f30649f9d4bd65e86a3181298c2772af91ade4fb0e080093
flatpak-session-helper-debuginfo-1.10.8-1.el8.ppc64le.rpm SHA-256: 9004091ebc849a81617eae524a1ca1891874bcd2224449c2bc1e80981618074e
flatpak-tests-debuginfo-1.10.8-1.el8.ppc64le.rpm SHA-256: 6ea008099f419b0857bae8a5f866241984556e85238d96e136d44226e39a42d7

Red Hat CodeReady Linux Builder for ARM 64 8

SRPM
aarch64
flatpak-debuginfo-1.10.8-1.el8.aarch64.rpm SHA-256: 2616cc28fab757013b797459dd256c7fede9670f6123ccddea3bb380a423c110
flatpak-debugsource-1.10.8-1.el8.aarch64.rpm SHA-256: 261b821ee40518fe032fd32b3c37913ba7f6e31e85f620002b327423a8743317
flatpak-devel-1.10.8-1.el8.aarch64.rpm SHA-256: 177ab55b937ebe923becaf113106b02d404d73c4ca2146f71e25580d4e387f05
flatpak-libs-debuginfo-1.10.8-1.el8.aarch64.rpm SHA-256: 417e9b57b758498b29b699e230c336fb704cfef39e26576d6e629e6ba83081bb
flatpak-session-helper-debuginfo-1.10.8-1.el8.aarch64.rpm SHA-256: 8658fa776f98884d8d565bbab5b676521ee63862d8bc51df81a75df7b2e4a51d
flatpak-tests-debuginfo-1.10.8-1.el8.aarch64.rpm SHA-256: 746a8becca356adeefbc51cdd26659f23dd307c09d5c24b2853334364c132c23

Red Hat CodeReady Linux Builder for IBM z Systems 8

SRPM
s390x
flatpak-debuginfo-1.10.8-1.el8.s390x.rpm SHA-256: 388841e86f16e2ca1b30e000401c2d2a2f6f98ef8d2d23323a48ef8551a435a7
flatpak-debugsource-1.10.8-1.el8.s390x.rpm SHA-256: 6730dfcd322d428e579f059635ebc6f30541daf4f6edc2bdd995582017ec5c56
flatpak-devel-1.10.8-1.el8.s390x.rpm SHA-256: 086e4d5384f800df786a96f85c3fb94a4d68a9e6dc4b5ae0b9865dc858b1cfa0
flatpak-libs-debuginfo-1.10.8-1.el8.s390x.rpm SHA-256: aa90aecb3d48543ddd61c2bb85fe37949b63bc5758c5ec8b9d48293b1b5a0c4a
flatpak-session-helper-debuginfo-1.10.8-1.el8.s390x.rpm SHA-256: a2d67ab446a4b7cb001c7bca8b7383efbad8b4752b78fdbdcefb8054966ed595
flatpak-tests-debuginfo-1.10.8-1.el8.s390x.rpm SHA-256: 718f4bb809b4557428cf42641ede5f141ffb14e0561a9f1627b85c75881905a4

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.