Red Hat Enterprise Linux 10 vulnerability

What happened

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.

Affected versions

Red Hat Enterprise Linux 10: See vendor advisory Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.