Every CVE Search/ Get API key

CVE-2021-43860

Permissions granted to applications can be hidden from the user at install time

8.2 HighFix available

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the actual metadata, from the "metadata" file to ensure it wasn't lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from before the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

1.44%Down 0.4 points since Jan 13, 2022
90%50%10%1%

What each source reports

CVE List Score used 8.2

Permissions granted to applications can be hidden from the user at install time

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the actual metadata, from the "metadata" file to ensure it wasn't lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from before the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.

Record
CVE-2021-43860
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-269
Updated
2026-11-02
EUVDEUVD-2021-30724 8.2

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the actual metadata, from the "metadata" file to ensure it wasn't lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from before the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.

Record
EUVD-2021-30724
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-03
NVD 8.2

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the actual metadata, from the "metadata" file to ensure it wasn't lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from before the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.

Record
CVE-2021-43860
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-269, CWE-276
Updated
2026-11-02
OSVALPINE-CVE-2021-43860 8.6

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the actual metadata, from the "metadata" file to ensure it wasn't lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from before the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.

Record
ALPINE-CVE-2021-43860
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-03
OSV 8.6

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the actual metadata, from the "metadata" file to ensure it wasn't lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from before the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.

Record
CVE-2021-43860
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-43860 8.6

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the actual metadata, from the "metadata" file to ensure it wasn't lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from before the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.

Record
DEBIAN-CVE-2021-43860
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 11 moreShow less
OSVOESA-2022-1520 8.6

flatpak security update

Application deployment framework for desktop apps.

Security Fix(es):

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the actual metadata, from the "metadata" file to ensure it wasn't lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from before the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.(CVE-2021-43860)

Record
OESA-2022-1520
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:1792 8.2

Red Hat Security Advisory: flatpak security and bug fix update

Record
RHSA-2022:1792
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2022:1792 8.2

Moderate: flatpak security and bug fix update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Permissions granted to applications can be hidden from the user at install time (CVE-2021-43860)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Record
RLSA-2022:1792
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2021-43860 8.2

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the actual metadata, from the "metadata" file to ensure it wasn't lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from before the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.

Record
UBUNTU-CVE-2021-43860
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2022:1792 No score

Moderate: flatpak security and bug fix update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Permissions granted to applications can be hidden from the user at install time (CVE-2021-43860)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:1792
Updated
2026-11-02
OSVCLSA-2026-1777541348 No score

flatpak: Fix of CVE-2021-43860

  • CVE-2021-43860: hidden permissions via null byte in metadata file
Record
CLSA-2026-1777541348
Updated
2026-11-02
OSVMGASA-2022-0131 No score

Updated flatpak packages fix security vulnerability

Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. (CVE-2021-43860) Path traversal vulnerability (CVE-2022-21682) Various other fixes and enhancements included in update to version 1.12.7.

Record
MGASA-2022-0131
Updated
2026-11-02
OSVopenSUSE-SU-2022:0712-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

Update to flatpak 1.10.7:

  • CVE-2022-21682: Introduce new option --nofilesystem=host:reset to support flatpak-builder 1.2.2 (bsc#1194611).
  • CVE-2021-43860: A malicious repository could hav sent invalid application metadata in a way that hides some of the app permissions displayed during installation (bsc#1194610).
Record
openSUSE-SU-2022:0712-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11740-1 No score

flatpak-1.12.3-1.1 on GA media

These are all security issues fixed in the flatpak-1.12.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11740-1
Updated
2026-11-02
OSVSUSE-SU-2022:0712-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

Update to flatpak 1.10.7:

  • CVE-2022-21682: Introduce new option --nofilesystem=host:reset to support flatpak-builder 1.2.2 (bsc#1194611).
  • CVE-2021-43860: A malicious repository could hav sent invalid application metadata in a way that hides some of the app permissions displayed during installation (bsc#1194610).
Record
SUSE-SU-2022:0712-1
Updated
2026-11-02
OSVSUSE-SU-2022:3284-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • CVE-2021-41133: Fixed sandbox bypass via recent syscalls (bsc#1191507).
  • CVE-2021-43860: Fixed metadata validation (bsc#1194610).
Record
SUSE-SU-2022:3284-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
flatpak
Alpine:v3.15
 1.11.1 up to 1.12.3-r0
1.12.3-r0
flatpak
Alpine:v3.16
 1.11.1 up to 1.12.3-r0
1.12.3-r0
flatpak
Alpine:v3.17
 1.11.1 up to 1.12.3-r0
1.12.3-r0
flatpak
Alpine:v3.18
 1.11.1 up to 1.12.3-r0
1.12.3-r0
flatpak
Alpine:v3.19
 1.11.1 up to 1.12.3-r0
1.12.3-r0
flatpak
Alpine:v3.20
 1.11.1 up to 1.12.3-r0
1.12.3-r0
flatpak
Alpine:v3.21
 1.11.1 up to 1.12.3-r0
1.12.3-r0
flatpak
Alpine:v3.22
 1.11.1 up to 1.12.3-r0
1.12.3-r0
flatpak
Alpine:v3.23
 1.11.1 up to 1.12.3-r0
1.12.3-r0
flatpak
Alpine:v3.24
 1.11.1 up to 1.12.3-r0
1.12.3-r0
Show 60 moreShow less
Affected packages
PackageAffectedFixed
flatpak
AlmaLinux:8
 before 1.8.7-1.el8
1.8.7-1.el8
flatpak-devel
AlmaLinux:8
 before 1.8.7-1.el8
1.8.7-1.el8
flatpak-libs
AlmaLinux:8
 before 1.8.7-1.el8
1.8.7-1.el8
flatpak-selinux
AlmaLinux:8
 before 1.8.7-1.el8
1.8.7-1.el8
flatpak-session-helper
AlmaLinux:8
 before 1.8.7-1.el8
1.8.7-1.el8
flatpak
TuxCare:CentOS:7
 before 1.0.9-13.el7_9.tuxcare.els2
1.0.9-13.el7_9.tuxcare.els2
flatpak-builder
TuxCare:CentOS:7
 before 1.0.0-13.el7_9.tuxcare.els2
1.0.0-13.el7_9.tuxcare.els2
flatpak-devel
TuxCare:CentOS:7
 before 1.0.9-13.el7_9.tuxcare.els2
1.0.9-13.el7_9.tuxcare.els2
flatpak-libs
TuxCare:CentOS:7
 before 1.0.9-13.el7_9.tuxcare.els2
1.0.9-13.el7_9.tuxcare.els2
flatpak
Debian:12
 before 1.12.3-1
1.12.3-1
flatpak
Debian:13
 before 1.12.3-1
1.12.3-1
flatpak
Debian:14
 before 1.12.3-1
1.12.3-1
flatpak
Debian:11
From an advisory covering 2 CVEs
 before 1.10.7-0+deb11u1, plus listed versions
1.10.2-31.10.3-0+deb11u11.10.3-0+deb11u1~bpo11+11.10.5-0+deb11u11.10.5-0+deb11u1~bpo10+11.10.7-0+deb11u1~bpo10+1
1.10.7-0+deb11u1
flatpak
Mageia:8
From an advisory covering 2 CVEs
 before 1.12.7-1.mga8
1.12.7-1.mga8
discover
Mageia:8
From an advisory covering 2 CVEs
 before 5.20.4-3.3.mga8
5.20.4-3.3.mga8
gnome-software
Mageia:8
From an advisory covering 2 CVEs
 before 3.38.0-2.1.mga8
3.38.0-2.1.mga8
xdg-desktop-portal-kde
Mageia:8
From an advisory covering 2 CVEs
 before 5.20.4-2.1.mga8
5.20.4-2.1.mga8
flatpak
openEuler:20.03-LTS-SP1
 before 1.0.3-10.oe1
1.0.3-10.oe1
flatpak
openEuler:20.03-LTS-SP2
 before 1.0.3-10.oe1
1.0.3-10.oe1
flatpak
openEuler:20.03-LTS-SP3
 before 1.0.3-8.oe1
1.0.3-8.oe1
flatpak
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak-libs
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak-selinux
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak-session-helper
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak-session-helper-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak-tests-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak
Red Hat:enterprise_linux:8::crb
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak-devel
Red Hat:enterprise_linux:8::crb
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak-libs-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak-session-helper
Red Hat:enterprise_linux:8::crb
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak-session-helper-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak-tests-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak
Rocky Linux:8
 before 0:1.8.7-1.el8
0:1.8.7-1.el8
flatpak
SUSE:Linux Enterprise Module for Desktop Applications 15 SP3
From an advisory covering 2 CVEs
 before 1.10.7-4.12.1
1.10.7-4.12.1
flatpak
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 2 CVEs
 before 1.10.7-4.12.1
1.10.7-4.12.1
flatpak
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 2 CVEs
 before 1.10.7-4.12.1
1.10.7-4.12.1
flatpak
SUSE:Linux Enterprise Real Time 15 SP2
From an advisory covering 2 CVEs
 before 1.10.7-4.12.1
1.10.7-4.12.1
flatpak
SUSE:Linux Enterprise Server 15 SP2-BCL
From an advisory covering 2 CVEs
 before 1.10.7-4.12.1
1.10.7-4.12.1
flatpak
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 2 CVEs
 before 1.10.7-4.12.1
1.10.7-4.12.1
flatpak
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 2 CVEs
 before 1.10.7-4.12.1
1.10.7-4.12.1
flatpak
SUSE:Manager Proxy 4.1
From an advisory covering 2 CVEs
 before 1.10.7-4.12.1
1.10.7-4.12.1
flatpak
SUSE:Manager Retail Branch Server 4.1
From an advisory covering 2 CVEs
 before 1.10.7-4.12.1
1.10.7-4.12.1
flatpak
SUSE:Manager Server 4.1
From an advisory covering 2 CVEs
 before 1.10.7-4.12.1
1.10.7-4.12.1
flatpak
SUSE:Enterprise Storage 7
From an advisory covering 2 CVEs
 before 1.10.7-4.12.1
1.10.7-4.12.1
flatpak
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 3 CVEs
 before 1.2.3-150100.4.8.1
1.2.3-150100.4.8.1
flatpak
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 3 CVEs
 before 1.2.3-150100.4.8.1
1.2.3-150100.4.8.1
flatpak
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 3 CVEs
 before 1.2.3-150100.4.8.1
1.2.3-150100.4.8.1
flatpak
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 3 CVEs
 before 1.2.3-150100.4.8.1
1.2.3-150100.4.8.1
flatpak
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 3 CVEs
 before 1.2.3-150100.4.8.1
1.2.3-150100.4.8.1
flatpak
SUSE:Enterprise Storage 6
From an advisory covering 3 CVEs
 before 1.2.3-150100.4.8.1
1.2.3-150100.4.8.1
flatpak
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
0.8.7-50.10.0-10.10.0-20.10.1-10.10.2-1
Show 16 moreShow less
0.10.2.1-10.10.2.1-20.10.3-10.11.1-0ubuntu10.11.3-20.11.3-30.11.7-0ubuntu0.11.0.1-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.18.04.11.0.8-0ubuntu0.18.04.11.0.9-0ubuntu0.11.0.9-0ubuntu0.21.0.9-0ubuntu0.31.0.9-0ubuntu0.41.0.9-0ubuntu0.4+esm1
 None known
flatpak
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.4.3-11.6.0-11.6.1-11.6.2-11.6.3-1
Show 6 moreShow less
1.6.5-0ubuntu0.11.6.5-0ubuntu0.21.6.5-0ubuntu0.31.6.5-0ubuntu0.41.6.5-0ubuntu0.51.6.5-0ubuntu0.5+esm1
 None known
flatpak
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.10.2-31.12.2-11.12.2-21.12.3-11.12.4-1
Show 5 moreShow less
1.12.5-11.12.6-11.12.7-11.12.7-1ubuntu0.11.12.7-1ubuntu0.1+esm1
 None known
flatpak
openSUSE:Leap 15.3
From an advisory covering 2 CVEs
 before 1.10.7-4.12.1
1.10.7-4.12.1
flatpak
openSUSE:Tumbleweed
 before 1.12.3-1.1
1.12.3-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-43860 is a high vulnerability (CVSS 8.2) in Debian Linux, published January 12, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in flatpak 1.12.3-r0.

References

Show 46 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open