Description
firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry, or (5) setEntries D-Bus API method.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | firewalld | 0.4.3.3-1 | — |
| Debian 13 | firewalld | 0.4.3.3-1 | — |
| Debian 12 | firewalld | 0.4.3.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | firewalld | 0.4.0-1ubuntu0.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | firewalld +4 | 0.4.3.2-8.el7 | RHSA-2016:2597 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | firewalld | 0.4.4.2-1.1 | openSUSE-SU-2024:10205-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | firewalld +4 | 0.4.3.2-8.el7 | ELSA-2016-2597 |
Advisories 3
- RHSA-2016:2597 Red Hat Security Advisory: firewalld security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10205-1 firewall-applet-0.4.4.2-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ELSA-2016-2597 Moderate: firewalld security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 9, 2016
References
- http://www.firewalld.org/2016/08/firewalld-0-4-3-3-release
- FEDORA-2016-4dedc6ec3d vendor-advisory
- FEDORA-2016-de55d2c2c9 vendor-advisory
- 92481 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1360135
- GLSA-201701-70 vendor-advisory
- RHSA-2016:2597 vendor-advisory
- [oss-security] 20160816 firewalld: Firewall configuration can be modified by any logged in user mailing-list