Summary
The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the AlmaLinux entitlement platform.
Security Fix(es):
* subscription-manager: inadequate authorization of com.AlmaLinux.RHSM1 D-Bus interface allows local users to modify configuration (CVE-2023-3899)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | dnf-plugin-subscription-manager | 1.28.36-3.el8_8.alma.1 |
| AlmaLinux · 8 | python3-cloud-what | 1.28.36-3.el8_8.alma.1 |
| AlmaLinux · 8 | python3-subscription-manager-rhsm | 1.28.36-3.el8_8.alma.1 |
| AlmaLinux · 8 | python3-syspurpose | 1.28.36-3.el8_8.alma.1 |
| AlmaLinux · 8 | subscription-manager | 1.28.36-3.el8_8.alma.1 |
| AlmaLinux · 8 | subscription-manager-migration | 1.28.36-3.el8_8.alma.1 |
| AlmaLinux · 8 | subscription-manager-plugin-ostree | 1.28.36-3.el8_8.alma.1 |
| AlmaLinux · 8 | subscription-manager-rhsm-certificates | 1.28.36-3.el8_8.alma.1 |
Vulnerabilities 1
-
High 7.8
Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration
A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration…