Headline
RHSA-2023:4707: Red Hat Security Advisory: subscription-manager security update
An update for subscription-manager is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
Synopsis
Important: subscription-manager security update
Type/Severity
Security Advisory: Important
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update for subscription-manager is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
Security Fix(es):
- subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration (CVE-2023-3899)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Products
- Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.0 x86_64
- Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.0 s390x
- Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.0 ppc64le
- Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.0 aarch64
- Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0 ppc64le
- Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0 x86_64
- Red Hat Enterprise Linux Server for ARM 64 - 4 years of updates 9.0 aarch64
- Red Hat Enterprise Linux Server for IBM z Systems - 4 years of updates 9.0 s390x
Fixes
- BZ - 2225407 - CVE-2023-3899 subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration
Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.0
SRPM
subscription-manager-1.29.26.2-2.el9_0.src.rpm
SHA-256: 508bc7bf1148d1c17d2779f69ea36c33b4be9574b74504e75b696d40825f7e8f
x86_64
libdnf-plugin-subscription-manager-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: 1917e750ad7e7611a300155fc21f4a6da7ad741796989c25c5688d1608edacfe
libdnf-plugin-subscription-manager-debuginfo-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: 818965fa8b4401412f20eb0fc4659351628b7b8da9d195379546e8c51195457b
python3-cloud-what-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: 3774aba35fd23a574e85c86eb63516eff25685dcfb43ef37f7e1f87b099dcb7a
python3-subscription-manager-rhsm-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: a8920f10866e245abf8041005174b382290eec2600599a6ba664bcd214e9b4b7
python3-subscription-manager-rhsm-debuginfo-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: 4042dbc7dec1de0dc8defedb932dca9fdf4c5f58f4c4cc81e847da36867b9ae7
rhsm-icons-1.29.26.2-2.el9_0.noarch.rpm
SHA-256: 1978b89198004d88375caf106f9aa74edb819046184307b0bd17ea22a1c41828
subscription-manager-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: b4b288d9594582e55497f9f085731d666cf82875429d0b3198fed66659a55826
subscription-manager-cockpit-1.29.26.2-2.el9_0.noarch.rpm
SHA-256: e17d4c42096afda522f50273195237d52da09b0eb486df7a59391b8ac6591a43
subscription-manager-debuginfo-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: 6984690ddac3a38ecb441f9f81c52fd9979415bb34cb6e842f41b885f4093755
subscription-manager-debugsource-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: f73d70a5321ca03f5ae3d865a5e2b6ca7c221769bc81bbdccc891d888f5b2e3d
subscription-manager-plugin-ostree-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: 99238232d3ec06239c95929bf5f7ec28dfc43220646213af56df6f75b1d5491d
subscription-manager-rhsm-certificates-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: 3ba75e5c37e55bfb5592e85c5e321f6b994ef35b73800316d92f47af1557062a
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.0
SRPM
subscription-manager-1.29.26.2-2.el9_0.src.rpm
SHA-256: 508bc7bf1148d1c17d2779f69ea36c33b4be9574b74504e75b696d40825f7e8f
s390x
libdnf-plugin-subscription-manager-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: 4bab27eb15eac14a118371d8a67d81af0fe552429dbe7943cd33bfb88d91687f
libdnf-plugin-subscription-manager-debuginfo-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: 0277ab620ae7b9b66e11f0359a92512a77c3e95192c64acdad4b6d0318468960
python3-cloud-what-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: 170e2d3be5cba7a2432a22babd2e208c8397e32bf3354910ab7f20c66021aa19
python3-subscription-manager-rhsm-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: 4a934e8f576bfe7f6aa062aa99699e4f3bbbbb70a5bcf2ab8abc16a2562b719f
python3-subscription-manager-rhsm-debuginfo-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: 38de7fba9d4d4766ea8c811dafec7c71f1a199519c33ffb2c961b1a9ac0bc6f4
rhsm-icons-1.29.26.2-2.el9_0.noarch.rpm
SHA-256: 1978b89198004d88375caf106f9aa74edb819046184307b0bd17ea22a1c41828
subscription-manager-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: 94b641c04d958ec36dd30acc744c75c3411ad04b32f3794d3d224a78006febb7
subscription-manager-cockpit-1.29.26.2-2.el9_0.noarch.rpm
SHA-256: e17d4c42096afda522f50273195237d52da09b0eb486df7a59391b8ac6591a43
subscription-manager-debuginfo-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: ec17256a90785447263c89ca018ea626aba2d577d8cee596df53a26766df88e1
subscription-manager-debugsource-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: 3f5681aa1720a51897ab93d7cff89227b6ad5e8b7a0155bbfd26300080b4e35e
subscription-manager-plugin-ostree-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: e9925ab2cff5c166eb3ff3ded7c4b2184a8c074357c0d46ab586370ff9ef6510
subscription-manager-rhsm-certificates-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: c4d08cafb7e07c88d469667c70f9d134cbac44b97cc205ab03d1403b9833c7e6
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.0
SRPM
subscription-manager-1.29.26.2-2.el9_0.src.rpm
SHA-256: 508bc7bf1148d1c17d2779f69ea36c33b4be9574b74504e75b696d40825f7e8f
ppc64le
libdnf-plugin-subscription-manager-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: 8af82470e211a07cce182555b6d4506e1d8b190046c110b0c02b9bf088100684
libdnf-plugin-subscription-manager-debuginfo-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: 0e7ffe6984d9acdb5c1970466020971da8dcb0e0294827a0910568ada339b995
python3-cloud-what-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: f3fe8bd33a804d4ce39a29882201bd5bb81739d30d235ecf3c4f03d1a158dd55
python3-subscription-manager-rhsm-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: 8c9a084658016f188f9bec47ab28e34473a3715f54a07215a209bde5d996e2c5
python3-subscription-manager-rhsm-debuginfo-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: 36b6b0d418a71308f35b196666aa104a2679a07967b1048927b8eaf148480916
rhsm-icons-1.29.26.2-2.el9_0.noarch.rpm
SHA-256: 1978b89198004d88375caf106f9aa74edb819046184307b0bd17ea22a1c41828
subscription-manager-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: 2bdcd5fc8402e921fb889a59d4ce1f03edeadc20fc1c98f96629c0410c1eacd9
subscription-manager-cockpit-1.29.26.2-2.el9_0.noarch.rpm
SHA-256: e17d4c42096afda522f50273195237d52da09b0eb486df7a59391b8ac6591a43
subscription-manager-debuginfo-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: e7f0a82cbe19ef6c4635d621d50f2eba441b5ea7928fb3171a0524d8f6d2d028
subscription-manager-debugsource-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: 8743892c592157004420264e0410f199ade1a446afb49c6cfa369093a817e6a2
subscription-manager-plugin-ostree-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: f6b6ca5ed9d7921ca2bc9b98d0deb6f254fa636a2209356a6e0ad279de537aa0
subscription-manager-rhsm-certificates-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: c96a203f07ff2df0708895650db3c349f1cc3a519855b67da15b44491e81cfc9
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.0
SRPM
subscription-manager-1.29.26.2-2.el9_0.src.rpm
SHA-256: 508bc7bf1148d1c17d2779f69ea36c33b4be9574b74504e75b696d40825f7e8f
aarch64
libdnf-plugin-subscription-manager-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: cf7e700f4605b5f6dbb4006163e4e760a900ebfeef7d5616c0963680b4cfd5b7
libdnf-plugin-subscription-manager-debuginfo-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: c10bafe436bb2fac905decfb2dde0a902461b1115dfae2e16da1d21614125004
python3-cloud-what-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: ea32af77ab83dc28d92ccc5164d1ea00f01e28d1ed0ef4ad9c388bef533cbbab
python3-subscription-manager-rhsm-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: 88eb8ed8f81330f319600fd53cf7b05e30b39bce749412b9874f99b4663d36bf
python3-subscription-manager-rhsm-debuginfo-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: 0078a337645374065e316cd4c64e884c0bf32d9bbf92bfa77f2bfd5635dc1546
rhsm-icons-1.29.26.2-2.el9_0.noarch.rpm
SHA-256: 1978b89198004d88375caf106f9aa74edb819046184307b0bd17ea22a1c41828
subscription-manager-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: 88744eee5835d3f1499cd0387893ae1cdb738a56e3ef460cc049a6d5e4a854ac
subscription-manager-cockpit-1.29.26.2-2.el9_0.noarch.rpm
SHA-256: e17d4c42096afda522f50273195237d52da09b0eb486df7a59391b8ac6591a43
subscription-manager-debuginfo-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: af16207a8ef2f44bcb807363f03f8555c8f1245191a092c878f6dc17023e5c86
subscription-manager-debugsource-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: 51932e2fec0c2873c8225c761fec1f90dff99fab671e061bfbaa929efe431712
subscription-manager-plugin-ostree-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: 2eb4c1730aa37c9fa1d1108b34c13a01d1c6a22f2e56b3b91d67c2bda932811a
subscription-manager-rhsm-certificates-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: 089ea717e9bd997e455a900fcfc03b9f736241a12a88991f826bff69f56bc10f
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0
SRPM
subscription-manager-1.29.26.2-2.el9_0.src.rpm
SHA-256: 508bc7bf1148d1c17d2779f69ea36c33b4be9574b74504e75b696d40825f7e8f
ppc64le
libdnf-plugin-subscription-manager-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: 8af82470e211a07cce182555b6d4506e1d8b190046c110b0c02b9bf088100684
libdnf-plugin-subscription-manager-debuginfo-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: 0e7ffe6984d9acdb5c1970466020971da8dcb0e0294827a0910568ada339b995
python3-cloud-what-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: f3fe8bd33a804d4ce39a29882201bd5bb81739d30d235ecf3c4f03d1a158dd55
python3-subscription-manager-rhsm-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: 8c9a084658016f188f9bec47ab28e34473a3715f54a07215a209bde5d996e2c5
python3-subscription-manager-rhsm-debuginfo-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: 36b6b0d418a71308f35b196666aa104a2679a07967b1048927b8eaf148480916
rhsm-icons-1.29.26.2-2.el9_0.noarch.rpm
SHA-256: 1978b89198004d88375caf106f9aa74edb819046184307b0bd17ea22a1c41828
subscription-manager-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: 2bdcd5fc8402e921fb889a59d4ce1f03edeadc20fc1c98f96629c0410c1eacd9
subscription-manager-cockpit-1.29.26.2-2.el9_0.noarch.rpm
SHA-256: e17d4c42096afda522f50273195237d52da09b0eb486df7a59391b8ac6591a43
subscription-manager-debuginfo-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: e7f0a82cbe19ef6c4635d621d50f2eba441b5ea7928fb3171a0524d8f6d2d028
subscription-manager-debugsource-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: 8743892c592157004420264e0410f199ade1a446afb49c6cfa369093a817e6a2
subscription-manager-plugin-ostree-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: f6b6ca5ed9d7921ca2bc9b98d0deb6f254fa636a2209356a6e0ad279de537aa0
subscription-manager-rhsm-certificates-1.29.26.2-2.el9_0.ppc64le.rpm
SHA-256: c96a203f07ff2df0708895650db3c349f1cc3a519855b67da15b44491e81cfc9
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0
SRPM
subscription-manager-1.29.26.2-2.el9_0.src.rpm
SHA-256: 508bc7bf1148d1c17d2779f69ea36c33b4be9574b74504e75b696d40825f7e8f
x86_64
libdnf-plugin-subscription-manager-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: 1917e750ad7e7611a300155fc21f4a6da7ad741796989c25c5688d1608edacfe
libdnf-plugin-subscription-manager-debuginfo-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: 818965fa8b4401412f20eb0fc4659351628b7b8da9d195379546e8c51195457b
python3-cloud-what-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: 3774aba35fd23a574e85c86eb63516eff25685dcfb43ef37f7e1f87b099dcb7a
python3-subscription-manager-rhsm-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: a8920f10866e245abf8041005174b382290eec2600599a6ba664bcd214e9b4b7
python3-subscription-manager-rhsm-debuginfo-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: 4042dbc7dec1de0dc8defedb932dca9fdf4c5f58f4c4cc81e847da36867b9ae7
rhsm-icons-1.29.26.2-2.el9_0.noarch.rpm
SHA-256: 1978b89198004d88375caf106f9aa74edb819046184307b0bd17ea22a1c41828
subscription-manager-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: b4b288d9594582e55497f9f085731d666cf82875429d0b3198fed66659a55826
subscription-manager-cockpit-1.29.26.2-2.el9_0.noarch.rpm
SHA-256: e17d4c42096afda522f50273195237d52da09b0eb486df7a59391b8ac6591a43
subscription-manager-debuginfo-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: 6984690ddac3a38ecb441f9f81c52fd9979415bb34cb6e842f41b885f4093755
subscription-manager-debugsource-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: f73d70a5321ca03f5ae3d865a5e2b6ca7c221769bc81bbdccc891d888f5b2e3d
subscription-manager-plugin-ostree-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: 99238232d3ec06239c95929bf5f7ec28dfc43220646213af56df6f75b1d5491d
subscription-manager-rhsm-certificates-1.29.26.2-2.el9_0.x86_64.rpm
SHA-256: 3ba75e5c37e55bfb5592e85c5e321f6b994ef35b73800316d92f47af1557062a
Red Hat Enterprise Linux Server for ARM 64 - 4 years of updates 9.0
SRPM
subscription-manager-1.29.26.2-2.el9_0.src.rpm
SHA-256: 508bc7bf1148d1c17d2779f69ea36c33b4be9574b74504e75b696d40825f7e8f
aarch64
libdnf-plugin-subscription-manager-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: cf7e700f4605b5f6dbb4006163e4e760a900ebfeef7d5616c0963680b4cfd5b7
libdnf-plugin-subscription-manager-debuginfo-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: c10bafe436bb2fac905decfb2dde0a902461b1115dfae2e16da1d21614125004
python3-cloud-what-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: ea32af77ab83dc28d92ccc5164d1ea00f01e28d1ed0ef4ad9c388bef533cbbab
python3-subscription-manager-rhsm-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: 88eb8ed8f81330f319600fd53cf7b05e30b39bce749412b9874f99b4663d36bf
python3-subscription-manager-rhsm-debuginfo-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: 0078a337645374065e316cd4c64e884c0bf32d9bbf92bfa77f2bfd5635dc1546
rhsm-icons-1.29.26.2-2.el9_0.noarch.rpm
SHA-256: 1978b89198004d88375caf106f9aa74edb819046184307b0bd17ea22a1c41828
subscription-manager-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: 88744eee5835d3f1499cd0387893ae1cdb738a56e3ef460cc049a6d5e4a854ac
subscription-manager-cockpit-1.29.26.2-2.el9_0.noarch.rpm
SHA-256: e17d4c42096afda522f50273195237d52da09b0eb486df7a59391b8ac6591a43
subscription-manager-debuginfo-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: af16207a8ef2f44bcb807363f03f8555c8f1245191a092c878f6dc17023e5c86
subscription-manager-debugsource-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: 51932e2fec0c2873c8225c761fec1f90dff99fab671e061bfbaa929efe431712
subscription-manager-plugin-ostree-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: 2eb4c1730aa37c9fa1d1108b34c13a01d1c6a22f2e56b3b91d67c2bda932811a
subscription-manager-rhsm-certificates-1.29.26.2-2.el9_0.aarch64.rpm
SHA-256: 089ea717e9bd997e455a900fcfc03b9f736241a12a88991f826bff69f56bc10f
Red Hat Enterprise Linux Server for IBM z Systems - 4 years of updates 9.0
SRPM
subscription-manager-1.29.26.2-2.el9_0.src.rpm
SHA-256: 508bc7bf1148d1c17d2779f69ea36c33b4be9574b74504e75b696d40825f7e8f
s390x
libdnf-plugin-subscription-manager-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: 4bab27eb15eac14a118371d8a67d81af0fe552429dbe7943cd33bfb88d91687f
libdnf-plugin-subscription-manager-debuginfo-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: 0277ab620ae7b9b66e11f0359a92512a77c3e95192c64acdad4b6d0318468960
python3-cloud-what-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: 170e2d3be5cba7a2432a22babd2e208c8397e32bf3354910ab7f20c66021aa19
python3-subscription-manager-rhsm-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: 4a934e8f576bfe7f6aa062aa99699e4f3bbbbb70a5bcf2ab8abc16a2562b719f
python3-subscription-manager-rhsm-debuginfo-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: 38de7fba9d4d4766ea8c811dafec7c71f1a199519c33ffb2c961b1a9ac0bc6f4
rhsm-icons-1.29.26.2-2.el9_0.noarch.rpm
SHA-256: 1978b89198004d88375caf106f9aa74edb819046184307b0bd17ea22a1c41828
subscription-manager-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: 94b641c04d958ec36dd30acc744c75c3411ad04b32f3794d3d224a78006febb7
subscription-manager-cockpit-1.29.26.2-2.el9_0.noarch.rpm
SHA-256: e17d4c42096afda522f50273195237d52da09b0eb486df7a59391b8ac6591a43
subscription-manager-debuginfo-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: ec17256a90785447263c89ca018ea626aba2d577d8cee596df53a26766df88e1
subscription-manager-debugsource-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: 3f5681aa1720a51897ab93d7cff89227b6ad5e8b7a0155bbfd26300080b4e35e
subscription-manager-plugin-ostree-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: e9925ab2cff5c166eb3ff3ded7c4b2184a8c074357c0d46ab586370ff9ef6510
subscription-manager-rhsm-certificates-1.29.26.2-2.el9_0.s390x.rpm
SHA-256: c4d08cafb7e07c88d469667c70f9d134cbac44b97cc205ab03d1403b9833c7e6
Related news
The Migration Toolkit for Containers (MTC) 1.8.0 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-26115: A flaw was found in the Node.js word-wrap module, where it is vulnerable to a denial of service caused by a Regular expression denial of service (ReDoS) issue in the result variable. By sending a specially crafted regex input, a remote attacker can cause a denial of service.
Red Hat Security Advisory 2023-5376-01 - Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include a denial of service vulnerability.
Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.13.3 on Red Hat Enterprise Linux 8 from Red Hat Container Registry. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-24540: A flaw was found in golang, where not all valid JavaScript white-space characters were considered white space. Due to this issue, templates containing white-space characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts ...
Red Hat Security Advisory 2023-5233-01 - OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization 4.13.4 images.
Logging Subsystem 5.5.16 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-4456: A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.
Red Hat OpenShift Virtualization release 4.13.4 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-41723: A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of requests.
Red Hat OpenShift Service Mesh Containers for 2.4.3 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-35942: A flaw was found in Envoy, where gRPC access loggers using the listener's global scope can cause a use-after-free crash when the listener is drained. This issue can be triggered by a listener discovery service (LDS) update with the same gRPC access log configuration.
Logging Subsystem 5.7.6 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-4456: A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.
Red Hat Security Advisory 2023-5103-01 - OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization 4.11.6 images.
An update is now available for Red Hat OpenShift GitOps 1.9. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-40029: A flaw was found in the ArgoCD package, used by Red Hat GitOps, that allows cluster secrets to be managed declaratively using the `kubectl apply` functionality, resulting in the full secret body being stored in `kubectl.kubernetes.io/last-applied-configuration` annotation. Since ArgoCD has included the ability to manage cluster labels and annotations via i...
Red Hat Security Advisory 2023-4982-01 - OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization 4.12.6 images.
Red Hat Security Advisory 2023-4731-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.13.10.
Red Hat Security Advisory 2023-4875-01 - Red Hat Advanced Cluster Management for Kubernetes 2.8.1 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which provide security updates and fix several bugs. Issues addressed include bypass and privilege escalation vulnerabilities.
Red Hat Security Advisory 2023-4706-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
Red Hat Security Advisory 2023-4705-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
Red Hat Security Advisory 2023-4702-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
Red Hat Security Advisory 2023-4708-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
Red Hat Security Advisory 2023-4701-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
Red Hat Security Advisory 2023-4703-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
Red Hat Security Advisory 2023-4707-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
Red Hat Security Advisory 2023-4704-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
An update for subscription-manager is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() me...
An update for subscription-manager is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged loca...
An update for subscription-manager is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 e...
An update for subscription-manager is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a signific...
An update for subscription-manager is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.S...