According to the versions of the flatpak packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability     affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the     build. At this point the build directory will have the full access that is specified in the manifest, so     running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is     not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch     `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead     to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these     empty directories can be created wherever the user has write permissions. However, a malicious application     could replace the `appstream-util` binary and potentially do something more hostile. This has been     resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and     `--nofilesystem=host`. (CVE-2022-21682)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2022:7458 advisory.

  - Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability     affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the     build. At this point the build directory will have the full access that is specified in the manifest, so     running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is     not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch     `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead     to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these     empty directories can be created wherever the user has write permissions. However, a malicious application     could replace the `appstream-util` binary and potentially do something more hostile. This has been     resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and     `--nofilesystem=host`. (CVE-2022-21682)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-7458 advisory.

    - Fix CVE-2022-21682 (#2042007)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2022_7458 advisory.

    * flatpak: flatpak-builder --mirror-screenshots-url can access files outside the build directory     (CVE-2022-21682)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-2026_0043 advisory.

    This advisory aggregates security fixes for the flatpak-builder SRPM in CIQ LTS 8.6. It addresses 1 CVE:
    CVE-2022-21682.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-021 advisory.

    An incorrect authorization vulnerability was found in Flatpak. Flatpak does not properly validate that the     permissions displayed to the user for an app at install time match the actual permissions granted to the     app at runtime in the case that there's a null byte in the metadata file of an app. This issue allows apps     to grant themselves permissions without the user's consent. (CVE-2021-43860)

    A path traversal vulnerability was found in Flatpak. This happens when flatpak-builder applies `finish-     args` last in the build. At this point the build directory will have the full access that is specified in     the manifest, so running `flatpak build` against it will gain those permissions. (CVE-2022-21682)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2023:0004 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-21682:
    Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability     affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the     build. At this point the build directory will have the full access that is specified in the manifest, so     running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is     not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch     `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead     to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these     empty directories can be created wherever the user has write permissions. However, a malicious application     could replace the `appstream-util` binary and potentially do something more hostile. This has been     resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and     `--nofilesystem=host`.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2022:7458 advisory.

  - flatpak: flatpak-builder --mirror-screenshots-url can access files outside the build directory     (CVE-2022-21682)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
159250	EulerOS 2.0 SP8 : flatpak (EulerOS-SA-2022-1343)	Nessus	Huawei Local Security Checks	2022/3/28	2022/3/28	medium
167309	AlmaLinux 8 : flatpak-builder (ALSA-2022:7458)	Nessus	Alma Linux Local Security Checks	2022/11/12	2022/11/12	medium
167545	Oracle Linux 8 : flatpak-builder (ELSA-2022-7458)	Nessus	Oracle Linux Local Security Checks	2022/11/15	2024/10/22	medium
358822	Rocky Linux 8 [CIQ] Security Update: flatpak-builder / flatpak-builder-debuginfo / etc (crlsa-2022_7458)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
359127	Rocky Linux 8.6 [CIQ] Security Update: flatpak-builder / flatpak-builder-debuginfo / etc (ciqsa-2026_0043)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
212482	Amazon Linux 2022 : flatpak, flatpak-devel, flatpak-libs (ALAS2022-2022-021)	Nessus	Amazon Linux Local Security Checks	2024/12/11	2024/12/11	high
236663	Alibaba Cloud Linux 3 : 0004: flatpak-builder (ALINUX3-SA-2023:0004)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
167189	CentOS 8 : flatpak-builder (CESA-2022:7458)	Nessus	CentOS Local Security Checks	2022/11/9	2022/11/9	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

high

medium

medium