Why is snapd updated very often recently?

raj

6/24/23, 10:48 AM

Did anybody of you using Ubuntu 20.04 also notice snapd being updated very often recently? If I remember correctly, snapd got updated 3 times over the last week, or so...

Why is this? Are there multiple vulnerabilities found in snapd that have been fixed one by one, or was there a series of unsuccessful fixes, that needed to be fixed again, or... ?

401

0 + 0

updates

snap

20.04

guiverc

6/24/23, 10:57 AM

Yes *flaws* were discovered *recently* and documented - eg. https://wiki.ubuntu.com/UbuntuWeeklyNewsletter/Issue723#New_Linux_Privilege_Escalation_Flaw_Uncovered_in_Snap_Package_Manager or the latest UWN

Score:8

Ubuntu

Artur Meinild

6/24/23, 10:57 AM

You could check the changelog (accessible from the Ubuntu Package site):

snapd (2.54.3+20.04.1ubuntu0.2) focal-security; urgency=medium

  * SECURITY REGRESSION: Fix fish shell compatibility
    - data/env/snapd.fish.in: more workarounds for even older fish shells,
      provide reasonable defaults.
    - LP: #1961791

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Wed, 23 Feb 2022 18:25:31 +0000

snapd (2.54.3+20.04.1ubuntu0.1) focal-security; urgency=medium

  * SECURITY REGRESSION: Fix fish shell compatibility
    - data/env/snapd.fish.in: fix fish env for all versions of fish, unexport
      local vars, export XDG_DATA_DIRS.
    - LP: #1961365

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Fri, 18 Feb 2022 21:31:48 +0000

snapd (2.54.3+20.04.1) focal-security; urgency=medium

  * debian/rules: disabling unit tests on riscv64

 -- Emilia Torino <emilia.torino@canonical.com>  Thu, 17 Feb 2022 15:37:53 -0300

snapd (2.54.3+20.04) focal-security; urgency=medium

  * SECURITY UPDATE: Sensitive information exposure
    - usersession/autostart: change ~/snap perms to 0700 on startup.
    - cmd: create ~/snap dir with 0700 perms.
    - CVE-2021-3155
    - LP: #1910298
  * SECURITY UPDATE: Local privilege escalation
    - snap-confine: Add validations of the location of the snap-confine
      binary within snapd.
    - snap-confine: Fix race condition in snap-confine when preparing a
      private mount namespace for a snap.
    - CVE-2021-44730
    - CVE-2021-44731
  * SECURITY UPDATE: Data injection from malicious snaps
    - interfaces: Add validations of snap content interface and layout
      paths in snapd.
    - CVE-2021-4120
    - LP: #1949368

 -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 15 Feb 2022 17:45:13 +0100

0 + 0