Skip to content
Fencer Vulns
medium 5.0

CVE-2023-28101 json

Flatpak metadata with ANSI control codes can cause misleading terminal output

published 2023-03-16 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-31826

cvss
5.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.

Patch / fix

  • flatpak flatpak 1.10.8, 1.12.8, 1.14.4, 1.15.4
  • flatpak Debian 14, Debian 13, Debian 12 1.14.4-1

debian advisories DEBIAN-CVE-2023-28101

  • flatpak RHEL 8 1.10.8-1.el8
  • flatpak-libs RHEL 8 1.10.8-1.el8
  • flatpak-selinux RHEL 8 1.10.8-1.el8
  • flatpak-session-helper RHEL 8 1.10.8-1.el8
  • flatpak RHEL 9 1.12.8-1.el9
  • flatpak-libs RHEL 9 1.12.8-1.el9
  • flatpak-selinux RHEL 9 1.12.8-1.el9
  • flatpak-session-helper RHEL 9 1.12.8-1.el9

red hat advisories RHSA-2023:7038RHSA-2023:6518

  • flatpak SLE Module for Desktop Applications 15 SP4, openSUSE Leap 15.4 1.12.8-150400.3.3.1
  • flatpak SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +7 more 1.10.8-150200.4.15.1
  • flatpak SLES for SAP 12 SP5, SLES 12 SP5 1.4.2-3.3.1
  • flatpak SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 1.2.3-150100.4.11.1

suse advisories SUSE-SU-2023:1715-1SUSE-SU-2023:1714-1SUSE-SU-2023:1713-1SUSE-SU-2023:1712-1

  • flatpak openSUSE Tumbleweed 1.14.4-1.1

opensuse advisories openSUSE-SU-2024:12800-1

  • flatpak AlmaLinux 8 1.10.8-1.el8
  • flatpak-libs AlmaLinux 8 1.10.8-1.el8
  • flatpak-selinux AlmaLinux 8 1.10.8-1.el8
  • flatpak-session-helper AlmaLinux 8 1.10.8-1.el8
  • flatpak AlmaLinux 9 1.12.8-1.el9
  • flatpak-libs AlmaLinux 9 1.12.8-1.el9
  • flatpak-selinux AlmaLinux 9 1.12.8-1.el9
  • flatpak-session-helper AlmaLinux 9 1.12.8-1.el9

almalinux advisories ALSA-2023:7038ALSA-2023:6518

  • flatpak Rocky Linux 9 1.12.8-1.el9

rocky linux advisories RLSA-2023:6518

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-28101 updated cvss 6.2

flatpak: Metadata with ANSI control codes can cause misleading terminal output

  • Red Hat Enterprise Linux 7 flatpak, flatpak-libs, flatpak-builder
    affected: workaround, no fix planned “Use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.”
  • Red Hat CodeReady Linux Builder (v. 8) flatpak 1.10.8-1.el8, flatpak-session-helper 1.10.8-1.el8
    fixed: vendor fix “Use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.” RHSA-2023:7038
  • Red Hat CodeReady Linux Builder (v. 9) flatpak 1.12.8-1.el9, flatpak-session-helper 1.12.8-1.el9
    fixed: vendor fix “Use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.” RHSA-2023:6518
  • Red Hat Enterprise Linux AppStream (v. 8) flatpak 1.10.8-1.el8, flatpak-libs 1.10.8-1.el8, flatpak-selinux 1.10.8-1.el8, flatpak-session-helper 1.10.8-1.el8
    fixed: vendor fix “Use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.” RHSA-2023:7038
  • Red Hat Enterprise Linux AppStream (v. 9) flatpak 1.12.8-1.el9, flatpak-libs 1.12.8-1.el9, flatpak-selinux 1.12.8-1.el9, flatpak-session-helper 1.12.8-1.el9
    fixed: vendor fix “Use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.” RHSA-2023:6518

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected products

  • flatpak flatpak

Classification

Weakness
  • CWE-116 Improper Encoding or Escaping of Output

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.