Your message dated Mon, 31 Aug 2026 13:47:05 +0000
with message-id <[email protected]>
and subject line Bug#1145655: fixed in bubblewrap 0.12.0-1~deb13u1
has caused the Debian Bug report #1145655,
regarding bubblewrap: GHSA-pxhw-h44j-8pfx: sandbox escape via symlink traversal
during setup
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1145655: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1145655
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: bubblewrap
Version: 0.1.0
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: Debian Security Team <[email protected]>
https://github.com/containers/bubblewrap/security/advisories/GHSA-pxhw-h44j-8pfx:
>If bubblewrap is used to create files on attacker controlled filesystem
>content (such as a malicious app image), then the attacker can use
>symlinks to redirect those file to be created on the host. This happens
>during setup of the sandbox, before anything is running, so there is no
>way to escape a sandbox at runtime.
>
>The bubblewrap arguments are not typically under the attackers control,
>so the risks depend on exactly how bwrap it is being used. Any files
>created by bubblewrap in this way are created by the uid/gid that
>launched bubblewrap, which is generally not root, so sandbox escapes
>are not privileged.
>
>This vulnerability affects Flatpak if a malicious or compromised app
>is used, and potentially affects other app frameworks that work in a
>similar way.
No CVE ID is currently available. Please reference as
GHSA-pxhw-h44j-8pfx until we have a CVE ID.
As previously discussed with the security team, fixing this in versions
older than 0.12.0 does not look feasible, so I'm going to prepare a
backport of 0.12.0 to stable.
smcv
--- End Message ---
--- Begin Message ---
Source: bubblewrap
Source-Version: 0.12.0-1~deb13u1
Done: Simon McVittie <[email protected]>
We believe that the bug you reported is fixed in the latest version of
bubblewrap, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Simon McVittie <[email protected]> (supplier of updated bubblewrap package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 26 Aug 2026 12:04:21 +0100
Source: bubblewrap
Architecture: source
Version: 0.12.0-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Utopia Maintenance Team
<[email protected]>
Changed-By: Simon McVittie <[email protected]>
Closes: 1145655
Changes:
bubblewrap (0.12.0-1~deb13u1) trixie-security; urgency=high
.
* Merge new upstream release from unstable
- Prevent sandbox escape via symlink traversal.
If an app framework such as Flatpak mounts subdirectories into a
directory controlled by the sandboxed app, a malicious or compromised
sandboxed app could create symlinks in that directory to arrange for
files/directories to be created on the host system.
(GHSA-pxhw-h44j-8pfx, no known CVE ID; Closes: #1145655)
- bubblewrap no longer supports running when setuid, matching the
upstream default. This ensures that vulnerabilities similar to
CVE-2026-41163 can't happen in future.
* Debian 13 backport changes:
- d/control, d/gbp.conf: Branch for Debian 13 stable updates
- Revert packaging changes that are not appropriate for a stable release
* Packaging changes since 0.11.0-2+deb13u1:
- d/rules: Stop passing -Dsupport_setuid=false.
The option no longer exists, and the new version of bubblewrap always
behaves as though its value was false.
- d/rules: Don't compile fallback code paths for kernel older than 5.10.
This ensures that we're using the safest available mechanisms,
using the openat2() syscall rather than emulating it in user-space.
As a result, this version will not work on kernels older than the
one found in Debian 11.
- d/rules: Install NEWS.md as the upstream changelog
- d/p/CVE-2026-41163/:
Drop patches, no longer needed/applicable with the new upstream release
-
d/p/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch:
Adjust patch to apply to the new upstream release
- d/README.Debian: Rewrite to reflect that setuid is no longer supported
- d/copyright: Update license from LGPL-2+ to LGPL-2.1+, matching upstream
.
bubblewrap (0.12.0-1) unstable; urgency=high
.
* New upstream release
- Prevent sandbox escape via symlink traversal.
If an app framework such as Flatpak mounts subdirectories into a
directory controlled by the sandboxed app, a malicious or compromised
sandboxed app could create symlinks in that directory to arrange for
files/directories to be created on the host system.
(GHSA-pxhw-h44j-8pfx, no known CVE ID; Closes: #1145655)
- d/rules: Stop passing -Dsupport_setuid=false.
The option no longer exists, and the new version of bubblewrap always
behaves as though its value was false.
- d/copyright: Update license from LGPL-2+ to LGPL-2.1+, matching upstream
-
d/p/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch:
Adjust patch to apply to the new upstream release
* d/rules: Don't compile fallback code paths for kernel older than 5.10.
This ensures that we're using the safest available mechanisms,
using the openat2() syscall rather than emulating it in user-space.
As a result, this version will not work on kernels older than the
one found in Debian 11.
.
bubblewrap (0.11.2-2) unstable; urgency=medium
.
* d/rules: Stop allowing bubblewrap to run when setuid, matching
the upstream default. This ensures that vulnerabilities similar to
CVE-2026-41163 can't happen in future.
* d/control, d/NEWS, d/README.Debian: Update documentation accordingly
* Standards-Version: 4.7.4 (no changes required)
Checksums-Sha1:
5518fac2bbaa07b5ad6bf907ab868427a1aaf308 2362 bubblewrap_0.12.0-1~deb13u1.dsc
183eaff6b078c1ea5ad55271e7d1fa5c8c0d339e 126452 bubblewrap_0.12.0.orig.tar.xz
87adaf7ecab19c7df09837dfeb347955405975d5 13728
bubblewrap_0.12.0-1~deb13u1.debian.tar.xz
9e0e7b7df67852aa5f0be41bbe4a061b30fa5967 7637
bubblewrap_0.12.0-1~deb13u1_source.buildinfo
Checksums-Sha256:
1abef77e6c35ce6c48c8969d31bffcc7a589bfd8e8fea9284fd8d77750f01d39 2362
bubblewrap_0.12.0-1~deb13u1.dsc
9760d007363e3abba7c747489910f9f82d9fca53ba3bd3282e396fa3c97a3314 126452
bubblewrap_0.12.0.orig.tar.xz
7b54f121aebf5d4b38360ea728274c26fa471582bc3e6658379b679ecd8b5a2f 13728
bubblewrap_0.12.0-1~deb13u1.debian.tar.xz
6d706aa8b531e8f0745e3cbc6fb0ecb26c8900bdb3813b31b69ccedb0fde72c0 7637
bubblewrap_0.12.0-1~deb13u1_source.buildinfo
Files:
66e88b791517fe7ae3dfcb496c7ec5f9 2362 admin optional
bubblewrap_0.12.0-1~deb13u1.dsc
323b059c9599b60b456bcf9e9800ff44 126452 admin optional
bubblewrap_0.12.0.orig.tar.xz
d804b9f84c9ed92fe0d912b40d61eb84 13728 admin optional
bubblewrap_0.12.0-1~deb13u1.debian.tar.xz
a9d0fd1cc18535a41cbd0032fa25eb54 7637 admin optional
bubblewrap_0.12.0-1~deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmqPKX8ACgkQEMKTtsN8
TjaD7Q//bOPiMak9bDOKeQEFXP4vhJ79AnyXrhr79FFHth6vIYXx570UVozkkku7
gzQe7I8kgrVwp0wmXvG/ySyguyZ5MV1BuovoCvDzsLDcJBrKMlZ/nUGIrWRJJYBa
km2d0y2/kgNTcA1oZyr2CpRiU14xFmrRiJHfStKln3XoDy2cy7RYTSltIScUopz1
rsEHvYX7Lqp8slW684q2rsW9ueSYeVwNyu8axlSgzcpwmG+92RyrAEVdXq7/z+xS
KBZqND+itbDLhrbHsq1yJU/wxDYgRiYP02mAHrHsXn0w91P9zLUhGxRMUHLIto8j
n5mPMheDFBZUgKfNwK4VHyPiYzZoE9B3jh9mJshABtWCRBpYnQCqHZ7qkM72z/Su
kRYFIXReZbSSrFG5CtknvUhwkwgysVOWC1CUyIitr3R7ASsvzO7UlgM5JuCB3U7U
B+0LnrHJ+opvmdxMMTqxRBi4nirGANi6GxuWSoFmVnD65upiuoZbhX3RDjwnXLe3
MMmvpuRHSGMlpeCREemy0ndV4hBwEICjogfzUMI8qHL56AmqfwX/6OcsGsCfw4Wa
GRBZ37hyrkc6my9R9qOwbH0z5ZZPtdZVaQtqHnnqS09llyoXzWIPlf6hU1irZ1M0
EDUqiDdoMhRiXI38XfJdbez1wq1+xoqTmRtVa03RCUOz4UhN3HY=
=XSuk
-----END PGP SIGNATURE-----
pgpqCPComZbd3.pgp
Description: PGP signature
--- End Message ---
