The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade subscription-manager-rhsm-certificatesUpgrade libdnf-plugin-subscription-managerUpgrade python3-syspurposeUpgrade subscription-managerUpgrade dnf-plugin-subscription-managerUpgrade subscription-manager-plugin-ostreeUpgrade python3-cloud-whatUpgrade subscription-manager-migrationUpgrade python3-subscription-manager-rhsm | Aug 24, 2023 | Aug 22, 2023 |
| Centos_linux | — | Upgrade subscription-manager-rhsmUpgrade subscription-manager-debuginfoUpgrade subscription-manager-plugin-containerUpgrade subscription-manager-rhsm-certificatesUpgrade subscription-manager-guiUpgrade subscription-manager-initial-setup-addonUpgrade subscription-manager-cockpitUpgrade rhsm-gtkUpgrade python-syspurposeUpgrade subscription-manager-plugin-ostreeUpgrade subscription-manager-migrationUpgrade subscription-manager | Aug 29, 2023 | Aug 23, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade subscription-managerUpgrade subscription-manager-plugin-ostreeUpgrade subscription-manager-rhsm-certificatesUpgrade dnf-plugin-subscription-managerUpgrade python3-syspurposeUpgrade subscription-manager-plugin-containerUpgrade python3-subscription-manager-rhsmUpgrade subscription-manager-cockpitUpgrade python2-subscription-manager-rhsm | Mar 13, 2024 | Aug 23, 2023 |
| Redhat_linux | — | Upgrade libdnf-plugin-subscription-manager-debuginfoUpgrade python3-subscription-manager-rhsmUpgrade subscription-manager-migrationUpgrade subscription-manager-initial-setup-addonUpgrade subscription-manager-cockpitUpgrade subscription-manager-guiUpgrade subscription-manager-debugsourceUpgrade rhsm-gtkUpgrade python3-syspurposeUpgrade subscription-manager-debuginfoUpgrade subscription-managerUpgrade python-syspurposeUpgrade dnf-plugin-subscription-manager-debuginfoUpgrade dnf-plugin-subscription-managerUpgrade python3-subscription-manager-rhsm-debuginfoUpgrade libdnf-plugin-subscription-managerUpgrade subscription-manager-plugin-ostreeUpgrade subscription-manager-plugin-containerUpgrade rhsm-iconsUpgrade python3-cloud-whatUpgrade subscription-manager-rhsm-certificatesUpgrade subscription-manager-rhsm | Aug 29, 2023 | Aug 23, 2023 |
| Rocky_linux | — | Upgrade dnf-plugin-subscription-manager-debuginfoUpgrade subscription-manager-rhsm-certificatesUpgrade libdnf-plugin-subscription-managerUpgrade subscription-manager-migrationUpgrade python3-cloud-whatUpgrade python3-subscription-manager-rhsmUpgrade python3-subscription-manager-rhsm-debuginfoUpgrade libdnf-plugin-subscription-manager-debuginfoUpgrade subscription-manager-debugsourceUpgrade subscription-manager-plugin-ostreeUpgrade subscription-managerUpgrade dnf-plugin-subscription-managerUpgrade subscription-manager-debuginfoUpgrade python3-syspurpose | Mar 5, 2024 | Aug 23, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub