CVE-2020-17367: 
NixOS vulnerability analysis and mitigation

Firejail through version 0.9.62 contains a security vulnerability identified as CVE-2020-17367. The vulnerability was discovered by Tim Starling and disclosed in August 2020. The issue affects the sandbox program that is designed to restrict the running environment of untrusted applications. The vulnerability exists because Firejail does not properly honor the -- end-of-options indicator after the --output option (Debian LTS, Debian Security).

The vulnerability stems from a flaw in how Firejail handles command-line options, specifically the end-of-options separator (--) after the --output option. This implementation flaw could allow an attacker with control over the command line options of the sandboxed application to write data to a specified file. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows an attacker with control over the command line options of the sandboxed application to write data to arbitrary files on the system. This could potentially lead to unauthorized file modifications and compromise of system integrity (Debian Security, OpenSUSE).

The vulnerability requires local access and control over the command line arguments of the sandboxed application. An attacker who meets these prerequisites could exploit the vulnerability to write data to specified files, potentially leading to system compromise (Debian Security).

The vulnerability has been fixed in multiple distribution releases: Debian Buster version 0.9.58.2-2+deb10u1, Debian 9 Stretch version 0.9.44.8-2+deb9u1, Fedora 31/32 version 0.9.62.4-1, and Gentoo version 0.9.64. Users are strongly recommended to upgrade their Firejail installations to the patched versions (Debian Security, Fedora, Gentoo).