mirror/flatpak
1
0
Fork 0
mirror of https://github.com/flatpak/flatpak.git synced 2026-04-07 00:26:56 -04:00
Code Issues Packages Projects Releases Wiki Activity

Update NEWS for release

Browse Source
This commit is contained in:
Alexander Larsson
2022-02-03 12:43:14 +01:00
parent f85a239b7a
commit fb5b7f0a4e
1 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
NEWS
View File

@@ -1,3 +1,28 @@
Changes in 1.8.7
~~~~~~~~~~~~~~~~
Released: 2022-02-03
This is a security update that fixes two issues that were found in flatpak:
https://github.com/flatpak/flatpak/security/advisories/GHSA-qpjc-vq3c-572j
(also known as CVE-2021-43860)
This issue is about the possibility for a malicious repository to send
invalid application metadata in a way that hides some of the app
permissions displayed during installation.
https://github.com/flatpak/flatpak/security/advisories/GHSA-8ch7-5j3h-g4fx
(also known as CVE-2022-21682)
This issue is a problem with how flatpak-builder uses flatpak, that
can cause `flatpak-builder --mirror-screenshots-url` commands to be
allowed to create directories outside of the build directory.
The fix for this is is the addition of a new option
`--nofilesystem=host:reset`, which in addition to behaving like
`--nofilesystem=host`, the new option prevents filesystem permissions
from being inherited from the app manifest.
Changes in 1.8.6
~~~~~~~~~~~~~~~~
Released: 2022-01-24