{"id":167905,"date":"2026-04-08T11:11:59","date_gmt":"2026-04-08T09:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-vo-flatpak-pozvolyayushhaya-vypolnit-kod-vne-izolirovannogo-okruzheniya"},"modified":"2026-04-08T11:11:59","modified_gmt":"2026-04-08T09:11:59","slug":"uyazvimost-vo-flatpak-pozvolyayushhaya-vypolnit-kod-vne-izolirovannogo-okruzheniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-vo-flatpak-pozvolyayushhaya-vypolnit-kod-vne-izolirovannogo-okruzheniya","title":{"rendered":"Vulnerabilitate \u00een Flatpak care permite executarea de cod \u00een afara mediului izolat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>\u00centr-o actualizare corectiv\u0103 publicat\u0103 acum c\u00e2teva ore pentru sistemul de pachete auto-suficiente Flatpak 1.16.4, precum \u0219i \u00een versiunea experimental\u0103 1.17.4, a fost remediat\u0103 o vulnerabilitate (CVE-2026-34078) care permite unei aplica\u021bii mali\u021bioase sau compromise \u00een format flatpak s\u0103 ocoleasc\u0103 modul de izolare prin sandbox, s\u0103 ob\u021bin\u0103 acces la fi\u0219ierele din sistemul principal \u0219i s\u0103 execute cod arbitrar \u00een afara modului de izolare. Problema a fost clasat\u0103 cu un nivel critic de pericol (9.3 din 10).      <\/p>\n<p>Vulnerabilitatea este prezent\u0103 \u00een serviciul D-Bus flatpak-portal, care permite rularea \u201eportalelor\u201d utilizate pentru a organiza accesul la resursele mediului gazd\u0103 din aplica\u021bii izolate. Problema este cauzat\u0103 de faptul c\u0103 serviciul flatpak-portal permite aplica\u021biei s\u0103 specifice \u00een op\u021biunea sandbox-expose c\u0103i de fi\u0219iere, care, din cauza lipsei unor verific\u0103ri adecvate, pot fi linkuri simbolice, indic\u00e2nd p\u0103r\u021bi arbitrare ale sistemului de fi\u0219iere.  <\/p>\n<p>\u00cenainte de a monta, serviciul dezv\u0103luie linkul simbolic \u0219i monteaz\u0103 \u00een mediul sandbox calea la care acesta indic\u0103, ceea ce permite ocolirea izol\u0103rii \u0219i ob\u021binerea accesului de citire \u0219i scriere la fi\u0219ierele mediului gazd\u0103. Pentru a organiza executarea propriului cod \u00een sistem, de exemplu, se poate ad\u0103uga un script de autoconfigurare, cum ar fi \u201e~\/.bashrc\u201d sau \u201e~\/.profile\u201d, sau se poate modifica fi\u0219ierul \u201e~\/.ssh\/authorized_keys\u201d cu cheile SSH.      <\/p>\n<p>Starea rezolv\u0103rii vulnerabilit\u0103\u021bii \u00een distribu\u021bii poate fi evaluat\u0103 pe aceste pagini (dac\u0103 pagina nu este disponibil\u0103, \u00eenseamn\u0103 c\u0103 dezvoltatorii distribu\u021biei nu au \u00eenceput \u00eenc\u0103 examinarea problemei): Debian, Ubuntu, SUSE, RHEL, Gentoo, Arch, Fedora. Ca o solu\u021bie alternativ\u0103 de protec\u021bie, se poate dezactiva serviciul flatpak-portal: sudo systemctl --global mask flatpak-portal.service &amp;&amp; systemctl --user stop flatpak-portal.service      <\/p>\n<p>Pe l\u00e2ng\u0103 vulnerabilitatea critic\u0103, \u00een noua versiune au fost remediate \u0219i alte trei probleme de securitate:  <\/p>\n<ul>\n<li class=\"l\"> Posibilitatea (CVE-2026-34079) de a \u0219terge un fi\u0219ier arbitrar din sistemul de fi\u0219iere al sistemului gazd\u0103. Problema este cauzat\u0103 de faptul c\u0103 flatpak, \u00een timpul cur\u0103\u021b\u0103rii cache-ului \u00eenvechit ld.so, nu verific\u0103 dac\u0103 fi\u0219ierul \u0219ters se afl\u0103 efectiv \u00een directorul de cache.\n<li class=\"l\"> Posibilitatea de a citi fi\u0219iere arbitrare \u00een contextul system-helper pe sistemele cu un depozit de imagini OCI configurat prin manipularea linkurilor simbolice.\n<li class=\"l\"> Capacitatea de a interveni \u00een procesarea cererilor de anulare a desc\u0103rc\u0103rilor aplica\u021biilor, permi\u021b\u00e2nd unui utilizator s\u0103 \u00eempiedice un alt utilizator s\u0103 opreasc\u0103 desc\u0103rcarea.          <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=65170\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432 \u043d\u0430\u0437\u0430\u0434 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0441\u0430\u043c\u043e\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Flatpak 1.16.4, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 1.17.4, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-34078), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c\u0443 \u0438\u043b\u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044e \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 flatpak, \u043e\u0431\u043e\u0439\u0442\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u0440\u0435\u0436\u0438\u043c sandbox-\u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432\u043d\u0435 \u0440\u0435\u0436\u0438\u043c\u0430 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.3 \u0438\u0437 10). [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-167905","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432 \u043d\u0430\u0437\u0430\u0434 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0441\u0430\u043c\u043e\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Flatpak 1.16.4, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 1.17.4, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-34078), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-vo-flatpak-pozvolyayushhaya-vypolnit-kod-vne-izolirovannogo-okruzheniya\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043e Flatpak, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432\u043d\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432 \u043d\u0430\u0437\u0430\u0434 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0441\u0430\u043c\u043e\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Flatpak 1.16.4, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 1.17.4, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-34078), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-vo-flatpak-pozvolyayushhaya-vypolnit-kod-vne-izolirovannogo-okruzheniya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-04-08T09:11:59+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-04-08T09:11:59+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een Flatpak care permite executarea de cod \u00een afara mediului izolat | ProHoster","description":"\u00centr-o versiune corectiv\u0103 publicat\u0103 acum c\u00e2teva ore a sistemului de pachete autonome Flatpak 1.16.4, precum \u0219i \u00een versiunea experimental\u0103 1.17.4, a fost remediat\u0103 o vulnerabilitate (CVE-2026-34078) care permite.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-vo-flatpak-pozvolyayushhaya-vypolnit-kod-vne-izolirovannogo-okruzheniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043e Flatpak, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432\u043d\u0435 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u0412 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432 \u043d\u0430\u0437\u0430\u0434 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0441\u0430\u043c\u043e\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 Flatpak 1.16.4, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 1.17.4, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-34078), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-vo-flatpak-pozvolyayushhaya-vypolnit-kod-vne-izolirovannogo-okruzheniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-04-08T09:11:59+00:00","article:modified_time":"2026-04-08T09:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/167905","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=167905"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/167905\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=167905"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=167905"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=167905"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}