CVE-2019-8308 : Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the app

Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.

Published 2019-02-12 23:29:00

Updated 2020-08-24 17:37:01

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2019-8308

Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Desktop » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Workstation » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Aus » Version: 7.6
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Eus » Version: 7.6
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Tus » Version: 7.6
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
Matching versions
Flatpak » Flatpak
Versions from including (>=) 1.1.0 and up to, including, (<=) 1.1.3
cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*
Matching versions
Flatpak » Flatpak
Versions before (<) 1.0.7
cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*
Matching versions
Flatpak » Flatpak
Versions from including (>=) 1.2.0 and up to, including, (<=) 1.2.3
cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2019-8308

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 18 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-8308

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.4	MEDIUM	AV:L/AC:M/Au:N/C:P/I:P/A:P	3.4	6.4	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.2	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H	1.5	6.0	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-8308

CWE-668 Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-8308

https://access.redhat.com/errata/RHSA-2019:0375

RHSA-2019:0375 - Security Advisory - Red Hat Customer Portal
Third Party Advisory
https://github.com/flatpak/flatpak/releases/tag/1.0.7

Release Release 1.0.7 (security update) · flatpak/flatpak · GitHub
Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=922059

#922059 - flatpak: CVE-2019-8308: vulnerability similar to runc CVE-2019-5736 involving /proc/self/exe - Debian Bug report logs
Issue Tracking;Mailing List;Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00088.html

[security-announce] openSUSE-SU-2019:2038-1: moderate: Security update f

CVEs referencing this url
https://github.com/flatpak/flatpak/releases/tag/1.2.3

Release Release 1.2.3 (security update) · flatpak/flatpak · GitHub
Third Party Advisory

Jump to

Vulnerability Details : CVE-2019-8308

Products affected by CVE-2019-8308

Exploit prediction scoring system (EPSS) score for CVE-2019-8308

CVSS scores for CVE-2019-8308

CWE ids for CVE-2019-8308

References for CVE-2019-8308