Description
Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Enterprise Linux 10
Default version status: affected
Red Hat Red Hat Enterprise Linux 7
Default version status: affected
Red Hat Red Hat Enterprise Linux 8
Default version status: affected
Red Hat Red Hat Enterprise Linux 9
Default version status: affected