{"id":99423,"date":"2021-03-14T10:22:36","date_gmt":"2021-03-14T08:22:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-flatpak-1-10-2-s-ustraneniem-uyazvimosti-narushayushhej-sandbox-izolyacziyu"},"modified":"2021-03-14T10:22:36","modified_gmt":"2021-03-14T08:22:36","slug":"obnovlenie-flatpak-1-10-2-s-ustraneniem-uyazvimosti-narushayushhej-sandbox-izolyacziyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-flatpak-1-10-2-s-ustraneniem-uyazvimosti-narushayushhej-sandbox-izolyacziyu","title":{"rendered":"Mise \u00e0 jour de Flatpak 1.10.2 corrigeant une vuln\u00e9rabilit\u00e9 affectant l'isolation du sandbox.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Une mise \u00e0 jour corrective est disponible pour l'outil de cr\u00e9ation de paquets autonomes Flatpak 1.10.2, laquelle corrige une vuln\u00e9rabilit\u00e9 (CVE-2021-21381) permettant \u00e0 l'auteur du paquet d'application de contourner le mode d'isolation sandbox \u00e9tabli et d'acc\u00e9der aux fichiers sur le syst\u00e8me principal. Le probl\u00e8me se manifeste \u00e0 partir de la version 0.9.4. <\/p>\n

La vuln\u00e9rabilit\u00e9 est caus\u00e9e par une erreur dans l'impl\u00e9mentation de la fonction de redirection d'acc\u00e8s au fichier (\u00ab file forwarding \u00bb), qui permet d'acc\u00e9der, par manipulation d'un fichier .desktop, \u00e0 des ressources dans un syst\u00e8me de fichiers externe interdites d'acc\u00e8s par l'application en cours d'ex\u00e9cution. En ajoutant des fichiers avec les \u00e9tiquettes \u00ab @@ \u00bb et \u00ab @@u \u00bb dans le champ Exec, flatpak consid\u00e9rera que les fichiers cibles sp\u00e9cifi\u00e9s ont \u00e9t\u00e9 explicitement indiqu\u00e9s par l'utilisateur et ouvrira automatiquement l'acc\u00e8s \u00e0 ces fichiers dans le sandbox. Cette vuln\u00e9rabilit\u00e9 peut \u00eatre exploit\u00e9e par les auteurs de paquets malveillants pour organiser l'acc\u00e8s \u00e0 des fichiers externes, malgr\u00e9 l'apparence d'ex\u00e9cution en mode isol\u00e9.
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0441\u0430\u043c\u043e\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Flatpak 1.10.2, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-21381), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0430\u0432\u0442\u043e\u0440\u0443 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u043e\u0431\u043e\u0439\u0442\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u0440\u0435\u0436\u0438\u043c sandbox-\u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 0.9.4. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0444\u0430\u0439\u043b\u0443 («file forwarding»), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99423","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mise \u00e0 jour Flatpak 1.10.2 corrigeant une vuln\u00e9rabilit\u00e9 affectant l'isolation sandbox | ProHoster","description":"Une mise \u00e0 jour corrective est disponible pour l'outil de cr\u00e9ation de paquets autonomes Flatpak 1.10.2, laquelle corrige une vuln\u00e9rabilit\u00e9 (CVE-2021-21381) permettant \u00e0 l'auteur du paquet d'application de contourner l'isolation \u00e9tablie.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-flatpak-1-10-2-s-ustraneniem-uyazvimosti-narushayushhej-sandbox-izolyacziyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Flatpak 1.10.2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u0430\u0440\u0443\u0448\u0430\u044e\u0449\u0435\u0439 sandbox-\u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0441\u0430\u043c\u043e\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Flatpak 1.10.2, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-21381), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0430\u0432\u0442\u043e\u0440\u0443 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u043e\u0431\u043e\u0439\u0442\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-flatpak-1-10-2-s-ustraneniem-uyazvimosti-narushayushhej-sandbox-izolyacziyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-03-14T08:22:36+00:00","article:modified_time":"2021-03-14T08:22:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99423","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-14 14:04:53","updated":"2022-10-05 23:18:52","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/99423","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=99423"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/99423\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=99423"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=99423"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=99423"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}