This bug was fixed in the package flatpak - 1.8.2-1ubuntu0.2
---------------
flatpak (1.8.2-1ubuntu0.2) groovy-security; urgency=medium
* SECURITY UPDATE: Flatpak sandbox escape via crafted .desktop file
(LP: #1918482)
- debian/patches/CVE-2021-21381-1.patch: Disallow @@ and @@u usage in
desktop files.
- debian/patches/CVE-2021-21381-2.patch: dir: Reserve the whole @@
prefix.
- debian/patches/CVE-2021-21381-3.patch: dir: Refuse to export
.desktop files with suspicious uses.
- CVE-2021-21381
-- Andrew Hayzen <ahay...@ubuntu.com> Wed, 10 Mar 2021 20:54:38 +0000
** Changed in: flatpak (Ubuntu Groovy)
Status: In Progress => Fix Released
** Changed in: flatpak (Ubuntu Focal)
Status: In Progress => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Desktop Bugs, which is subscribed to flatpak in Ubuntu.
https://bugs.launchpad.net/bugs/1918482
Title:
Update for CVE-2021-21381
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/flatpak/+bug/1918482/+subscriptions
--
desktop-bugs mailing list
desktop-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/desktop-bugs
