The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3593:03 advisory.

    * flatpak: Permissions granted to applications can be hidden from the user at install time     (CVE-2021-43860)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777541348 advisory.

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6,     Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time     match the actual permissions granted to the app at runtime, in the case that there's a null byte in the     metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user.
    Flatpak shows permissions to the user during install by reading them from the xa.metadata key in the     commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak     compares these permissions to the *actual* metadata, from the metadata file to ensure it wasn't lied to.
    However, the actual metadata contents are loaded in several places where they are read as simple C-style     strings. That means that, if the metadata file includes a null terminator, only the content of the file     from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the     metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously     crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted     sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an     update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the     permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.
    (CVE-2021-43860)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0413 advisory.

    This advisory aggregates security fixes for the flatpak SRPM in CIQ LTS 9.2. It addresses 4 CVEs:
    CVE-2021-41133, CVE-2024-42472, CVE-2021-43860, CVE-2023-28101.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3284-1 advisory.

    - CVE-2021-41133: Fixed sandbox bypass via recent syscalls (bsc#1191507).
    - CVE-2021-43860: Fixed metadata validation (bsc#1194610).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-1792 advisory.

    [1.8.7-1]
    - Rebase to 1.8.7 (#2041972)

    [1.8.6-1]
    - Rebase to 1.8.6 (#2010533)

    [1.8.5-6]
    - Fix CVE-2021-41133 (#2012869)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2022:1792 advisory.

  - flatpak: Permissions granted to applications can be hidden from the user at install time (CVE-2021-43860)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:1792 advisory.

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6,     Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time     match the actual permissions granted to the app at runtime, in the case that there's a null byte in the     metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user.
    Flatpak shows permissions to the user during install by reading them from the xa.metadata key in the     commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak     compares these permissions to the *actual* metadata, from the metadata file to ensure it wasn't lied to.
    However, the actual metadata contents are loaded in several places where they are read as simple C-style     strings. That means that, if the metadata file includes a null terminator, only the content of the file     from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the     metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously     crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted     sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an     update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the     permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.
    (CVE-2021-43860)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of flatpak installed on the remote host is prior to 1.0.9-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2518 advisory.

    Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6,     Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time     match the actual permissions granted to the app at runtime, in the case that there's a null byte in the     metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user.
    Flatpak shows permissions to the user during install by reading them from the xa.metadata key in the     commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak     compares these permissions to the *actual* metadata, from the metadata file to ensure it wasn't lied to.
    However, the actual metadata contents are loaded in several places where they are read as simple C-style     strings. That means that, if the metadata file includes a null terminator, only the content of the file     from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the     metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously     crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted     sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an     update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the     permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.
    (CVE-2021-43860)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6,     Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time     match the actual permissions granted to the app at runtime, in the case that there's a null byte in the     metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user.
    Flatpak shows permissions to the user during install by reading them from the xa.metadata key in the     commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak     compares these permissions to the *actual* metadata, from the metadata file to ensure it wasn't lied to.
    However, the actual metadata contents are loaded in several places where they are read as simple C-style     strings. That means that, if the metadata file includes a null terminator, only the content of the file     from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the     metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously     crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted     sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an     update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the     permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.
    (CVE-2021-43860)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-021 advisory.

    An incorrect authorization vulnerability was found in Flatpak. Flatpak does not properly validate that the     permissions displayed to the user for an app at install time match the actual permissions granted to the     app at runtime in the case that there's a null byte in the metadata file of an app. This issue allows apps     to grant themselves permissions without the user's consent. (CVE-2021-43860)

    A path traversal vulnerability was found in Flatpak. This happens when flatpak-builder applies `finish-     args` last in the build. At this point the build directory will have the full access that is specified in     the manifest, so running `flatpak build` against it will gain those permissions. (CVE-2022-21682)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2022_1792 advisory.

    * flatpak: Permissions granted to applications can be hidden from the user at install time     (CVE-2021-43860)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:1792 advisory.

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6,     Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time     match the actual permissions granted to the app at runtime, in the case that there's a null byte in the     metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user.
    Flatpak shows permissions to the user during install by reading them from the xa.metadata key in the     commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak     compares these permissions to the *actual* metadata, from the metadata file to ensure it wasn't lied to.
    However, the actual metadata contents are loaded in several places where they are read as simple C-style     strings. That means that, if the metadata file includes a null terminator, only the content of the file     from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the     metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously     crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted     sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an     update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the     permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.
    (CVE-2021-43860)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2022:0207 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-43860:
    Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6,     Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time     match the actual permissions granted to the app at runtime, in the case that there's a null byte in the     metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user.
    Flatpak shows permissions to the user during install by reading them from the xa.metadata key in the     commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak     compares these permissions to the *actual* metadata, from the metadata file to ensure it wasn't lied to.
    However, the actual metadata contents are loaded in several places where they are read as simple C-style     strings. That means that, if the metadata file includes a null terminator, only the content of the file     from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the     metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously     crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted     sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an     update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the     permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1792 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

    Security Fix(es):

    * flatpak: Permissions granted to applications can be hidden from the user at install time     (CVE-2021-43860)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-179 advisory.

    An incorrect authorization vulnerability was found in Flatpak. Flatpak does not properly validate that the     permissions displayed to the user for an app at install time match the actual permissions granted to the     app at runtime in the case that there's a null byte in the metadata file of an app. This issue allows apps     to grant themselves permissions without the user's consent. (CVE-2021-43860)

    A path traversal vulnerability was found in Flatpak. This happens when flatpak-builder applies `finish-     args` last in the build. At this point the build directory will have the full access that is specified in     the manifest, so running `flatpak build` against it will gain those permissions. (CVE-2022-21682)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
294198	MiracleLinux 8 : flatpak-1.8.7-1.el8 (AXSA:2022-3593:03)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
351871	CentOS Linux 7 [TuxCare] Security Update: flatpak / flatpak-builder / flatpak-devel / flatpak-libs (CENTOS7:CLSA-2026:1777541348)	Nessus	CentOS Local Security Checks	2026/9/30	2026/9/30	high
355888	Rocky Linux 9.2 [CIQ] Security Update: flatpak / flatpak-debuginfo / flatpak-debugsource / flatpak-devel / etc Multiple Vulnerabilities (ciqsa-2026_0413)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	high
165227	SUSE SLES15: flatpak / flatpak-devel / flatpak-zsh-completion / libflatpak0 / etc (SUSE-SU-2022:3284-1)	Nessus	SuSE Local Security Checks	2022/9/17	2026/6/25	high
161297	Oracle Linux 8 : flatpak (ELSA-2022-1792)	Nessus	Oracle Linux Local Security Checks	2022/5/18	2024/11/1	high
160921	CentOS 8 : flatpak (CESA-2022:1792)	Nessus	CentOS Local Security Checks	2022/5/10	2022/5/10	high
184964	Rocky Linux 8 : flatpak (RLSA-2022:1792)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2023/12/22	high
193525	Amazon Linux 2 : flatpak (ALAS-2024-2518)	Nessus	Amazon Linux Local Security Checks	2024/4/18	2024/12/11	high
256730	Linux Distros Unpatched Vulnerability : CVE-2021-43860	Nessus	Misc.	2025/8/27	2026/8/12	high
212482	Amazon Linux 2022 : flatpak, flatpak-devel, flatpak-libs (ALAS2022-2022-021)	Nessus	Amazon Linux Local Security Checks	2024/12/11	2024/12/11	high
357346	Rocky Linux 8 [CIQ] Security Update: flatpak / flatpak-debuginfo / flatpak-debugsource / flatpak-devel / etc (crlsa-2022_1792)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
161105	AlmaLinux 8 : flatpak (ALSA-2022:1792)	Nessus	Alma Linux Local Security Checks	2022/5/12	2022/5/12	high
236001	Alibaba Cloud Linux 3 : 0207: flatpak (ALINUX3-SA-2022:0207)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
160996	RHEL 8 : flatpak (RHSA-2022:1792)	Nessus	Red Hat Local Security Checks	2022/5/11	2024/11/7	high
167016	Amazon Linux 2022 : flatpak, flatpak-devel, flatpak-libs (ALAS2022-2022-179)	Nessus	Amazon Linux Local Security Checks	2022/11/5	2024/12/11	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high