{ "document": { "aggregate_severity": { "namespace": "https://nvd.nist.gov/vuln-metrics/cvss", "text": "Critical" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https:/www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "general", "text": "flatpak security update", "title": "Synopsis" }, { "category": "general", "text": "An update for flatpak is now available for openEuler-20.03-LTS-SP4", "title": "Summary" }, { "category": "general", "text": "flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.\n\nSecurity Fix(es):\n\nA vulnerability, which was classified as very critical, has been found in Flatpak up to 1.10.7/1.12.7/1.14.3/1.15.3.Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Impacted is confidentiality, integrity, and availability.Upgrading to version 1.10.8, 1.12.8, 1.14.4 or 1.15.4 eliminates this vulnerability.(CVE-2023-28100)", "title": "Description" }, { "category": "general", "text": "An update for flatpak is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP3/openEuler-24.03-LTS/openEuler-24.03-LTS-Next.\n\nopenEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Critical", "title": "Severity" }, { "category": "general", "text": "flatpak", "title": "Affected Component" } ], "publisher": { "category": "vendor", "contact_details": "openeuler-security@openeuler.org", "issuing_authority": "openEuler security committee", "name": "openEuler", "namespace": "https://www.openeuler.org" }, "references": [ { "category": "self", "summary": "openEuler-SA-2026-3852", "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3852" }, { "category": "self", "summary": "CVE-2023-28100", "url": "https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-28100&packageName=flatpak" }, { "category": "external", "summary": "nvd cve", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28100" }, { "category": "self", "summary": "openEuler-SA-2026-3852 vex file", "url": "https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-3852.json" } ], "title": "An update for flatpak is now available for openEuler-20.03-LTS-SP4", "tracking": { "current_release_date": "2026-09-16T17:55:40+08:00", "generator": { "date": "2026-09-16T17:55:40+08:00", "engine": { "name": "openEuler CSAF Tool V1.0" } }, "id": "openEuler-SA-2026-3852", "initial_release_date": "2026-09-16T17:55:40+08:00", "revision_history": [ { "date": "2026-09-16T17:55:40+08:00", "number": "1.0.0", "summary": "Initial" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "openEuler-20.03-LTS-SP4", "product": { "name": "openEuler-20.03-LTS-SP4", "product_id": "openEuler-20.03-LTS-SP4", "product_identification_helper": { "cpe": "cpe:/a:openEuler:openEuler:20.03-LTS-SP4" } } } ], "category": "product_name", "name": "openEuler" }, { "branches": [ { "category": "product_version", "name": "flatpak-help-1.0.3-15.oe2003sp4.noarch.rpm", "product": { "name": "flatpak-help-1.0.3-15.oe2003sp4.noarch.rpm", "product_id": "flatpak-help-1.0.3-15.oe2003sp4.noarch.rpm", "product_identification_helper": { "cpe": "cpe:/a:openEuler:openEuler:20.03-LTS-SP4" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "flatpak-1.0.3-15.oe2003sp4.aarch64.rpm", "product": { "name": "flatpak-1.0.3-15.oe2003sp4.aarch64.rpm", "product_id": "flatpak-1.0.3-15.oe2003sp4.aarch64.rpm", "product_identification_helper": { "cpe": "cpe:/a:openEuler:openEuler:20.03-LTS-SP4" } } }, { "category": "product_version", "name": "flatpak-debuginfo-1.0.3-15.oe2003sp4.aarch64.rpm", "product": { "name": "flatpak-debuginfo-1.0.3-15.oe2003sp4.aarch64.rpm", "product_id": "flatpak-debuginfo-1.0.3-15.oe2003sp4.aarch64.rpm", "product_identification_helper": { "cpe": "cpe:/a:openEuler:openEuler:20.03-LTS-SP4" } } }, { "category": "product_version", "name": "flatpak-debugsource-1.0.3-15.oe2003sp4.aarch64.rpm", "product": { "name": "flatpak-debugsource-1.0.3-15.oe2003sp4.aarch64.rpm", "product_id": "flatpak-debugsource-1.0.3-15.oe2003sp4.aarch64.rpm", "product_identification_helper": { "cpe": "cpe:/a:openEuler:openEuler:20.03-LTS-SP4" } } }, { "category": "product_version", "name": "flatpak-devel-1.0.3-15.oe2003sp4.aarch64.rpm", "product": { "name": "flatpak-devel-1.0.3-15.oe2003sp4.aarch64.rpm", "product_id": "flatpak-devel-1.0.3-15.oe2003sp4.aarch64.rpm", "product_identification_helper": { "cpe": "cpe:/a:openEuler:openEuler:20.03-LTS-SP4" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "flatpak-1.0.3-15.oe2003sp4.src.rpm", "product": { "name": "flatpak-1.0.3-15.oe2003sp4.src.rpm", "product_id": "flatpak-1.0.3-15.oe2003sp4.src.rpm", "product_identification_helper": { "cpe": "cpe:/a:openEuler:openEuler:20.03-LTS-SP4" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "flatpak-1.0.3-15.oe2003sp4.x86_64.rpm", "product": { "name": "flatpak-1.0.3-15.oe2003sp4.x86_64.rpm", "product_id": "flatpak-1.0.3-15.oe2003sp4.x86_64.rpm", "product_identification_helper": { "cpe": "cpe:/a:openEuler:openEuler:20.03-LTS-SP4" } } }, { "category": "product_version", "name": "flatpak-debuginfo-1.0.3-15.oe2003sp4.x86_64.rpm", "product": { "name": "flatpak-debuginfo-1.0.3-15.oe2003sp4.x86_64.rpm", "product_id": "flatpak-debuginfo-1.0.3-15.oe2003sp4.x86_64.rpm", "product_identification_helper": { "cpe": "cpe:/a:openEuler:openEuler:20.03-LTS-SP4" } } }, { "category": "product_version", "name": "flatpak-debugsource-1.0.3-15.oe2003sp4.x86_64.rpm", "product": { "name": "flatpak-debugsource-1.0.3-15.oe2003sp4.x86_64.rpm", "product_id": "flatpak-debugsource-1.0.3-15.oe2003sp4.x86_64.rpm", "product_identification_helper": { "cpe": "cpe:/a:openEuler:openEuler:20.03-LTS-SP4" } } }, { "category": "product_version", "name": "flatpak-devel-1.0.3-15.oe2003sp4.x86_64.rpm", "product": { "name": "flatpak-devel-1.0.3-15.oe2003sp4.x86_64.rpm", "product_id": "flatpak-devel-1.0.3-15.oe2003sp4.x86_64.rpm", "product_identification_helper": { "cpe": "cpe:/a:openEuler:openEuler:20.03-LTS-SP4" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "openEuler" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "flatpak-help-1.0.3-15.oe2003sp4.noarch as a component of openEuler-20.03-LTS-SP4", "product_id": "openEuler-20.03-LTS-SP4:flatpak-help-1.0.3-15.oe2003sp4.noarch" }, "product_reference": "flatpak-help-1.0.3-15.oe2003sp4.noarch.rpm", "relates_to_product_reference": "openEuler-20.03-LTS-SP4" }, { "category": "default_component_of", "full_product_name": { "name": "flatpak-1.0.3-15.oe2003sp4.aarch64 as a component of openEuler-20.03-LTS-SP4", "product_id": "openEuler-20.03-LTS-SP4:flatpak-1.0.3-15.oe2003sp4.aarch64" }, "product_reference": "flatpak-1.0.3-15.oe2003sp4.aarch64.rpm", "relates_to_product_reference": "openEuler-20.03-LTS-SP4" }, { "category": "default_component_of", "full_product_name": { "name": "flatpak-debuginfo-1.0.3-15.oe2003sp4.aarch64 as a component of openEuler-20.03-LTS-SP4", "product_id": "openEuler-20.03-LTS-SP4:flatpak-debuginfo-1.0.3-15.oe2003sp4.aarch64" }, "product_reference": "flatpak-debuginfo-1.0.3-15.oe2003sp4.aarch64.rpm", "relates_to_product_reference": "openEuler-20.03-LTS-SP4" }, { "category": "default_component_of", "full_product_name": { "name": "flatpak-debugsource-1.0.3-15.oe2003sp4.aarch64 as a component of openEuler-20.03-LTS-SP4", "product_id": "openEuler-20.03-LTS-SP4:flatpak-debugsource-1.0.3-15.oe2003sp4.aarch64" }, "product_reference": "flatpak-debugsource-1.0.3-15.oe2003sp4.aarch64.rpm", "relates_to_product_reference": "openEuler-20.03-LTS-SP4" }, { "category": "default_component_of", "full_product_name": { "name": "flatpak-devel-1.0.3-15.oe2003sp4.aarch64 as a component of openEuler-20.03-LTS-SP4", "product_id": "openEuler-20.03-LTS-SP4:flatpak-devel-1.0.3-15.oe2003sp4.aarch64" }, "product_reference": "flatpak-devel-1.0.3-15.oe2003sp4.aarch64.rpm", "relates_to_product_reference": "openEuler-20.03-LTS-SP4" }, { "category": "default_component_of", "full_product_name": { "name": "flatpak-1.0.3-15.oe2003sp4.src as a component of openEuler-20.03-LTS-SP4", "product_id": "openEuler-20.03-LTS-SP4:flatpak-1.0.3-15.oe2003sp4.src" }, "product_reference": "flatpak-1.0.3-15.oe2003sp4.src.rpm", "relates_to_product_reference": "openEuler-20.03-LTS-SP4" }, { "category": "default_component_of", "full_product_name": { "name": "flatpak-1.0.3-15.oe2003sp4.x86_64 as a component of openEuler-20.03-LTS-SP4", "product_id": "openEuler-20.03-LTS-SP4:flatpak-1.0.3-15.oe2003sp4.x86_64" }, "product_reference": "flatpak-1.0.3-15.oe2003sp4.x86_64.rpm", "relates_to_product_reference": "openEuler-20.03-LTS-SP4" }, { "category": "default_component_of", "full_product_name": { "name": "flatpak-debuginfo-1.0.3-15.oe2003sp4.x86_64 as a component of openEuler-20.03-LTS-SP4", "product_id": "openEuler-20.03-LTS-SP4:flatpak-debuginfo-1.0.3-15.oe2003sp4.x86_64" }, "product_reference": "flatpak-debuginfo-1.0.3-15.oe2003sp4.x86_64.rpm", "relates_to_product_reference": "openEuler-20.03-LTS-SP4" }, { "category": "default_component_of", "full_product_name": { "name": "flatpak-debugsource-1.0.3-15.oe2003sp4.x86_64 as a component of openEuler-20.03-LTS-SP4", "product_id": "openEuler-20.03-LTS-SP4:flatpak-debugsource-1.0.3-15.oe2003sp4.x86_64" }, "product_reference": "flatpak-debugsource-1.0.3-15.oe2003sp4.x86_64.rpm", "relates_to_product_reference": "openEuler-20.03-LTS-SP4" }, { "category": "default_component_of", "full_product_name": { "name": "flatpak-devel-1.0.3-15.oe2003sp4.x86_64 as a component of openEuler-20.03-LTS-SP4", "product_id": "openEuler-20.03-LTS-SP4:flatpak-devel-1.0.3-15.oe2003sp4.x86_64" }, "product_reference": "flatpak-devel-1.0.3-15.oe2003sp4.x86_64.rpm", "relates_to_product_reference": "openEuler-20.03-LTS-SP4" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-28100", "notes": [ { "category": "description", "text": "A vulnerability, which was classified as very critical, has been found in Flatpak up to 1.10.7/1.12.7/1.14.3/1.15.3.Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Impacted is confidentiality, integrity, and availability.Upgrading to version 1.10.8, 1.12.8, 1.14.4 or 1.15.4 eliminates this vulnerability.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "openEuler-20.03-LTS-SP4:flatpak-help-1.0.3-15.oe2003sp4.noarch", "openEuler-20.03-LTS-SP4:flatpak-1.0.3-15.oe2003sp4.aarch64", "openEuler-20.03-LTS-SP4:flatpak-debuginfo-1.0.3-15.oe2003sp4.aarch64", "openEuler-20.03-LTS-SP4:flatpak-debugsource-1.0.3-15.oe2003sp4.aarch64", "openEuler-20.03-LTS-SP4:flatpak-devel-1.0.3-15.oe2003sp4.aarch64", "openEuler-20.03-LTS-SP4:flatpak-1.0.3-15.oe2003sp4.src", "openEuler-20.03-LTS-SP4:flatpak-1.0.3-15.oe2003sp4.x86_64", "openEuler-20.03-LTS-SP4:flatpak-debuginfo-1.0.3-15.oe2003sp4.x86_64", "openEuler-20.03-LTS-SP4:flatpak-debugsource-1.0.3-15.oe2003sp4.x86_64", "openEuler-20.03-LTS-SP4:flatpak-devel-1.0.3-15.oe2003sp4.x86_64" ] }, "remediations": [ { "category": "vendor_fix", "details": "flatpak security update", "product_ids": [ "openEuler-20.03-LTS-SP4:flatpak-help-1.0.3-15.oe2003sp4.noarch", "openEuler-20.03-LTS-SP4:flatpak-1.0.3-15.oe2003sp4.aarch64", "openEuler-20.03-LTS-SP4:flatpak-debuginfo-1.0.3-15.oe2003sp4.aarch64", "openEuler-20.03-LTS-SP4:flatpak-debugsource-1.0.3-15.oe2003sp4.aarch64", "openEuler-20.03-LTS-SP4:flatpak-devel-1.0.3-15.oe2003sp4.aarch64", "openEuler-20.03-LTS-SP4:flatpak-1.0.3-15.oe2003sp4.src", "openEuler-20.03-LTS-SP4:flatpak-1.0.3-15.oe2003sp4.x86_64", "openEuler-20.03-LTS-SP4:flatpak-debuginfo-1.0.3-15.oe2003sp4.x86_64", "openEuler-20.03-LTS-SP4:flatpak-debugsource-1.0.3-15.oe2003sp4.x86_64", "openEuler-20.03-LTS-SP4:flatpak-devel-1.0.3-15.oe2003sp4.x86_64" ], "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3852" } ], "scores": [ { "cvss_v3": { "baseScore": 10.0, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1" }, "products": [ "openEuler-20.03-LTS-SP4:flatpak-help-1.0.3-15.oe2003sp4.noarch", "openEuler-20.03-LTS-SP4:flatpak-1.0.3-15.oe2003sp4.aarch64", "openEuler-20.03-LTS-SP4:flatpak-debuginfo-1.0.3-15.oe2003sp4.aarch64", "openEuler-20.03-LTS-SP4:flatpak-debugsource-1.0.3-15.oe2003sp4.aarch64", "openEuler-20.03-LTS-SP4:flatpak-devel-1.0.3-15.oe2003sp4.aarch64", "openEuler-20.03-LTS-SP4:flatpak-1.0.3-15.oe2003sp4.src", "openEuler-20.03-LTS-SP4:flatpak-1.0.3-15.oe2003sp4.x86_64", "openEuler-20.03-LTS-SP4:flatpak-debuginfo-1.0.3-15.oe2003sp4.x86_64", "openEuler-20.03-LTS-SP4:flatpak-debugsource-1.0.3-15.oe2003sp4.x86_64", "openEuler-20.03-LTS-SP4:flatpak-devel-1.0.3-15.oe2003sp4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "CVE-2023-28100" } ] }