Description
libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libosinfo | 1.6.0-1 | — |
| Debian 13 | libosinfo | 1.6.0-1 | — |
| Debian 12 | libosinfo | 1.6.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libosinfo | No fix yet | — |
| Ubuntu 16.04 LTS | libosinfo | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | gnome-boxes | 3.28.5-7.el8 | RHSA-2019:3387 |
| RHEL 8 | libosinfo | 1.5.0-3.el8 | RHSA-2019:3387 |
| RHEL 8 | osinfo-db | 20190611-1.el8 | RHSA-2019:3387 |
| RHEL 8 | osinfo-db-tools | 1.5.0-4.el8 | RHSA-2019:3387 |
| RHEL 7 | libosinfo +2 | 1.1.0-5.el7 | RHSA-2020:1051 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | libosinfo | 1.2.0-3.3.2 | SUSE-SU-2024:1700-1 |
| SLES 12 SP1 | libosinfo | 0.2.12-13.3.1 | SUSE-SU-2019:2273-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | libosinfo | 1.2.0-3.3.2 | SUSE-SU-2024:1700-1 |
| SLES for SAP 12 SP1 | libosinfo | 0.2.12-13.3.1 | SUSE-SU-2019:2273-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libosinfo | 1.5.0-r1 | — |
| Alpine v3.23 | libosinfo | 1.5.0-r1 | — |
| Alpine v3.22 | libosinfo | 1.5.0-r1 | — |
| Alpine v3.21 | libosinfo | 1.5.0-r1 | — |
| Alpine v3.20 | libosinfo | 1.5.0-r1 | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | libosinfo | 1.5.0-r1 | — |
| Alpine v3.18 | libosinfo | 1.5.0-r1 | — |
| Alpine v3.17 | libosinfo | 1.5.0-r1 | — |
| Alpine v3.16 | libosinfo | 1.5.0-r1 | — |
| Alpine v3.15 | libosinfo | 1.5.0-r1 | — |
| Alpine v3.14 | libosinfo | 1.5.0-r1 | — |
| Alpine v3.13 | libosinfo | 1.5.0-r1 | — |
| Alpine v3.12 | libosinfo | 1.5.0-r1 | — |
| Alpine v3.11 | libosinfo | 1.5.0-r1 | — |
| Alpine v3.10 | libosinfo | 1.5.0-r1 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | libosinfo +2 | 1.1.0-5.amzn2 | ALAS2-2020-1527 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | gnome-boxes | 3.28.5-7.el8 | ELSA-2019-3387 |
| Oracle Linux 8 | libosinfo | 1.5.0-3.el8 | ELSA-2019-3387 |
| Oracle Linux 8 | osinfo-db | 20190611-1.0.2.el8 | ELSA-2019-3387 |
| Oracle Linux 8 | osinfo-db-tools | 1.5.0-4.el8 | ELSA-2019-3387 |
| Oracle Linux 7 | libosinfo +2 | 1.1.0-5.el7 | ELSA-2020-1051 |
Advisories 7
- RHSA-2020:1051 Red Hat Security Advisory: libosinfo security and bug fix update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2019:3387 Red Hat Security Advisory: osinfo-db and libosinfo security and bug fix update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- SUSE-SU-2024:1700-1 Security update for libosinfo SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2273-1 Security update for libosinfo SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2020-1527 Low: libosinfo security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 22, 2020
- ELSA-2020-1051 Low: libosinfo security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 6, 2020
- ELSA-2019-3387 Low: osinfo-db and libosinfo security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 14, 2019
References
- https://www.redhat.com/archives/libosinfo/2019-July/msg00026.html
- https://libosinfo.org/download/
- https://gitlab.com/libosinfo/libosinfo/-/tags
- https://gitlab.com/libosinfo/libosinfo/blob/master/NEWS
- [oss-security] 20190708 CVE-2019-13313, CVE-2019-13314: password disclosure via command line arguments mailing-list
- FEDORA-2019-e23aeac13e vendor-advisory
- FEDORA-2019-4b8990e4d6 vendor-advisory
- FEDORA-2019-c9fbe3db9c vendor-advisory
- FEDORA-2019-d2cde4761e vendor-advisory
- RHSA-2019:3387 vendor-advisory