This bug was fixed in the package flatpak - 1.0.9-0ubuntu0.2
---------------
flatpak (1.0.9-0ubuntu0.2) bionic-security; urgency=medium
* SECURITY UPDATE: Flatpak sandbox escape via spawn portal (LP: #1911473)
- debian/patches/CVE-2021-21261-1.patch: run: Convert all environment
variables into bwrap arguments.
- debian/patches/CVE-2021-21261-2.patch: common: Move
flatpak_buffer_to_sealed_memfd_or_tmpfile to its own file.
- debian/patches/CVE-2021-21261-3.patch: context: Add --env-fd option.
- debian/patches/CVE-2021-21261-4.patch: portal: Convert --env in
extra-args into --env-fd.
- debian/patches/CVE-2021-21261-5.patch: portal: Do not use caller-supplied
variables in environment.
- CVE-2021-21261
-- Paulo Flabiano Smorigo <pfsmor...@canonical.com> Tue, 19 Jan 2021
14:21:40 +0000
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1911473
Title:
Update for ghsa-4ppf-fxf6-vxg2
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/flatpak/+bug/1911473/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
