CVE-2023-28101
Fixed in a distro release EPSS <1%CVSS 5.0
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.
Products: flatpak
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | flatpak | 1.10.8-1.el8 |
| AlmaLinux 8 | flatpak-devel | 1.10.8-1.el8 |
| AlmaLinux 8 | flatpak-libs | 1.10.8-1.el8 |
| AlmaLinux 8 | flatpak-selinux | 1.10.8-1.el8 |
| AlmaLinux 8 | flatpak-session-helper | 1.10.8-1.el8 |
| AlmaLinux 9 | flatpak | 1.12.8-1.el9 |
| AlmaLinux 9 | flatpak-devel | 1.12.8-1.el9 |
| AlmaLinux 9 | flatpak-libs | 1.12.8-1.el9 |
| AlmaLinux 9 | flatpak-selinux | 1.12.8-1.el9 |
| AlmaLinux 9 | flatpak-session-helper | 1.12.8-1.el9 |
| Debian 12 | flatpak | 1.14.4-1 |
| Debian 13 | flatpak | 1.14.4-1 |
| Debian 14 | flatpak | 1.14.4-1 |
| Red Hat Enterprise Linux 8 | flatpak | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-debuginfo | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-debugsource | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-devel | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-libs | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-libs-debuginfo | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-selinux | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-session-helper | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-session-helper-debuginfo | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-tests-debuginfo | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 9 | flatpak | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-debuginfo | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-debugsource | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-devel | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-libs | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-libs-debuginfo | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-selinux | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-session-helper | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-session-helper-debuginfo | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-tests-debuginfo | 0:1.12.8-1.el9 |
| Rocky Linux 9 | flatpak | 0:1.12.8-1.el9 |
| SUSE Enterprise Storage 7 | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Enterprise Storage 7.1 | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | flatpak | 1.2.3-150100.4.11.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP4 | flatpak | 1.12.8-150400.3.3.1 |
| SUSE Linux Enterprise Real Time 15 SP3 | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Linux Enterprise Server 12 SP5 | flatpak | 1.4.2-3.3.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | flatpak | 1.2.3-150100.4.11.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | flatpak | 1.4.2-3.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | flatpak | 1.2.3-150100.4.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | flatpak | 1.10.8-150200.4.15.1 |
| Ubuntu 25.10 | flatpak | no fix |
| Ubuntu 26.04 LTS | flatpak | no fix |
| Ubuntu 26.10 | flatpak | no fix |
| Ubuntu Pro 18.04 LTS | flatpak | no fix |
| Ubuntu Pro 20.04 LTS | flatpak | no fix |
| Ubuntu Pro 22.04 LTS | flatpak | no fix |
| Ubuntu Pro 24.04 LTS | flatpak | no fix |
| openSUSE Leap 15.4 | flatpak | 1.12.8-150400.3.3.1 |
| openSUSE Tumbleweed | flatpak | 1.14.4-1.1 |