CVE-2019-10063

{"id": "CVE-2019-10063", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.2}]}, "published": "2019-03-26T14:29:00.240", "references": [{"url": "https://access.redhat.com/errata/RHSA-2019:1024", "source": "cve@mitre.org"}, {"url": "https://access.redhat.com/errata/RHSA-2019:1143", "source": "cve@mitre.org"}, {"url": "https://github.com/flatpak/flatpak/issues/2782", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI."}, {"lang": "es", "value": "Flatpak, en versiones anteriores a la 1.0.8, 1.1.x y 1.2.x anteriores a la 1.2.4, y en las versiones 1.3.x anteriores a la 1.3.1, permite omitir el sandbox. Las versiones de Flatpak desde la 0.8.1 abordan CVE-2017-5226 mediante un filtro seccomp para evitar que las aplicaciones del sandbox empleen el ioctl TIOCSTI, que podr\u00eda emplearse para inyectar comandos en la terminal de control para que se ejecuten fuera del sandbox una vez la aplicaci\u00f3n en el sandbox se cierra. La soluci\u00f3n estaba incompleta: en las plataformas de 64 bits, el filtro seccomp podr\u00eda ser omitido por un n\u00famero de petici\u00f3n ioctl que tiene TIOCSTI en los 32 bits menos significativos y un valor arbitrario que no es cero en sus 32 bits m\u00e1s significativos, lo que el kernel de Linux tratar\u00eda como un equivalente a TIOCSTI."}], "lastModified": "2019-05-13T10:29:02.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "760A9FE8-23B8-4901-9278-2558BEA362D3", "versionEndExcluding": "1.0.8"}, {"criteria": "cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "257A9820-7329-4F74-97F6-F695F38C116D", "versionEndIncluding": "1.1.3", "versionStartIncluding": "1.1.0"}, {"criteria": "cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B40E0D8-EF6D-4B52-87EF-97D17F131F56", "versionEndExcluding": "1.2.4", "versionStartIncluding": "1.2.0"}, {"criteria": "cpe:2.3:a:flatpak:flatpak:1.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56F607CF-96CC-4176-8336-1F00C6CA2B9E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}