RHSA-2023:4704 — Red Hat Security Advisory: subscription-manager security update

Fixed packages 57

Release	Package	Fixed in
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	dnf-plugin-subscription-manager-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	python3-subscription-manager-rhsm-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	rhsm-gtk	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	subscription-manager-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	subscription-manager-debugsource	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	subscription-manager-initial-setup-addon	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream	subscription-manager-migration	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos	dnf-plugin-subscription-manager	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos	dnf-plugin-subscription-manager-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos	python3-subscription-manager-rhsm	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos	python3-subscription-manager-rhsm-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos	python3-syspurpose	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos	rhsm-icons	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos	subscription-manager	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos	subscription-manager-cockpit	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos	subscription-manager-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos	subscription-manager-debugsource	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos	subscription-manager-plugin-ostree	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos	subscription-manager-rhsm-certificates	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream	dnf-plugin-subscription-manager-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream	python3-subscription-manager-rhsm-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream	rhsm-gtk	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream	subscription-manager-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream	subscription-manager-debugsource	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream	subscription-manager-initial-setup-addon	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream	subscription-manager-migration	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::baseos	dnf-plugin-subscription-manager	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::baseos	dnf-plugin-subscription-manager-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::baseos	python3-subscription-manager-rhsm	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::baseos	python3-subscription-manager-rhsm-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::baseos	python3-syspurpose	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::baseos	rhsm-icons	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::baseos	subscription-manager	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::baseos	subscription-manager-cockpit	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::baseos	subscription-manager-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::baseos	subscription-manager-debugsource	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::baseos	subscription-manager-plugin-ostree	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::baseos	subscription-manager-rhsm-certificates	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream	dnf-plugin-subscription-manager-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream	python3-subscription-manager-rhsm-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream	rhsm-gtk	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream	subscription-manager-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream	subscription-manager-debugsource	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream	subscription-manager-initial-setup-addon	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream	subscription-manager-migration	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::baseos	dnf-plugin-subscription-manager	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::baseos	dnf-plugin-subscription-manager-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::baseos	python3-subscription-manager-rhsm	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::baseos	python3-subscription-manager-rhsm-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::baseos	python3-syspurpose	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::baseos	rhsm-icons	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::baseos	subscription-manager	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::baseos	subscription-manager-cockpit	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::baseos	subscription-manager-debuginfo	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::baseos	subscription-manager-debugsource	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::baseos	subscription-manager-plugin-ostree	0:1.28.13-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::baseos	subscription-manager-rhsm-certificates	0:1.28.13-7.el8_4

Vulnerabilities 1

High 7.8

CVE-2023-3899

Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Azure Linux

Aug 23, 2023

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2225407
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4704.json
report
https://access.redhat.com/security/cve/CVE-2023-3899
advisory
https://www.cve.org/CVERecord?id=CVE-2023-3899
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-3899

Red Hat Security Advisory: subscription-manager security update

Fixed packages 57

Vulnerabilities 1

Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

References