Source: bubblewrap Version: 0.1.0 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: Debian Security Team <[email protected]>
https://github.com/containers/bubblewrap/security/advisories/GHSA-pxhw-h44j-8pfx: >If bubblewrap is used to create files on attacker controlled filesystem >content (such as a malicious app image), then the attacker can use >symlinks to redirect those file to be created on the host. This happens >during setup of the sandbox, before anything is running, so there is no >way to escape a sandbox at runtime. > >The bubblewrap arguments are not typically under the attackers control, >so the risks depend on exactly how bwrap it is being used. Any files >created by bubblewrap in this way are created by the uid/gid that >launched bubblewrap, which is generally not root, so sandbox escapes >are not privileged. > >This vulnerability affects Flatpak if a malicious or compromised app >is used, and potentially affects other app frameworks that work in a >similar way. No CVE ID is currently available. Please reference as GHSA-pxhw-h44j-8pfx until we have a CVE ID. As previously discussed with the security team, fixing this in versions older than 0.12.0 does not look feasible, so I'm going to prepare a backport of 0.12.0 to stable. smcv
