Security
Headlines
HeadlinesLatestCVEs

Headline

RHSA-2023:4703: Red Hat Security Advisory: subscription-manager security update

An update for subscription-manager is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

  • CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
Red Hat Security Data
#vulnerability#web#linux#red_hat#nodejs#js#kubernetes#aws#auth#sap

Skip to navigation Skip to main content

Utilities

  • Subscriptions
  • Downloads
  • Containers
  • Support Cases

Infrastructure and Management

  • Red Hat Enterprise Linux
  • Red Hat Satellite
  • Red Hat Subscription Management
  • Red Hat Insights
  • Red Hat Ansible Automation Platform

Cloud Computing

  • Red Hat OpenShift
  • Red Hat OpenStack Platform
  • Red Hat OpenShift Container Platform
  • Red Hat OpenShift Data Science
  • Red Hat OpenShift Dedicated
  • Red Hat Advanced Cluster Security for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes
  • Red Hat Quay
  • Red Hat CodeReady Workspaces
  • Red Hat OpenShift Service on AWS

Storage

  • Red Hat Gluster Storage
  • Red Hat Hyperconverged Infrastructure
  • Red Hat Ceph Storage
  • Red Hat OpenShift Data Foundation

Runtimes

  • Red Hat Runtimes
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Data Grid
  • Red Hat JBoss Web Server
  • Red Hat Single Sign On
  • Red Hat support for Spring Boot
  • Red Hat build of Node.js
  • Red Hat build of Quarkus

Integration and Automation

All Products

Issued:

2023-08-22

Updated:

2023-08-22

RHSA-2023:4703 - Security Advisory

  • Overview
  • Updated Packages

Synopsis

Important: subscription-manager security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for subscription-manager is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.

Security Fix(es):

  • subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration (CVE-2023-3899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Products

  • Red Hat Enterprise Linux Server - AUS 8.2 x86_64
  • Red Hat Enterprise Linux Server - TUS 8.2 x86_64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2 x86_64

Fixes

  • BZ - 2225407 - CVE-2023-3899 subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration

Red Hat Enterprise Linux Server - AUS 8.2

SRPM

subscription-manager-1.26.22-2.el8_2.src.rpm

SHA-256: f11bd3a24a5e0fcc3095c16f94325648ee58ecfe99a876c7fb2e0f964615e3a9

x86_64

dnf-plugin-subscription-manager-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 2834511250db331cdbb5c7a74c2e21c3fb14e10682e8451a9c1aa167d46ac901

dnf-plugin-subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 03be1c427d23b5d7208a38ddb78c272758fd31832c76f67f8ba4caa988d44aaf

dnf-plugin-subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 03be1c427d23b5d7208a38ddb78c272758fd31832c76f67f8ba4caa988d44aaf

python3-subscription-manager-rhsm-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 52bae4b13cf663fc67f05c438a299d6ce0374aef19d8fed9848925ce94369570

python3-subscription-manager-rhsm-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 43f8ea229c5c4a7a1170ec4a94de3ff3399746051c004c15b3955d2cf35cd4d3

python3-subscription-manager-rhsm-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 43f8ea229c5c4a7a1170ec4a94de3ff3399746051c004c15b3955d2cf35cd4d3

python3-syspurpose-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 6eccc3cb8349cf1fd06c692d8995052932da468fb83e460c0c71700ce5e00991

rhsm-gtk-1.26.22-2.el8_2.x86_64.rpm

SHA-256: fcfb5f132b87e9aed3defc5a918301f9af0f9e8a83c20c545e1f797113b7f7d9

rhsm-icons-1.26.22-2.el8_2.noarch.rpm

SHA-256: 5ebe70b2e4b498b2ce586cbcad7c0f49050464821d125a2a4c4c3babb4f52452

subscription-manager-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 18d04da502e027dd39e70ed0775a0fcefdcd8e63c9ecc0df8ada5a6c9c7017d8

subscription-manager-cockpit-1.26.22-2.el8_2.noarch.rpm

SHA-256: e40321c1062e18c9f0ea5bf9be9c03953c69c2eefe0b452cfb5abf005228fb20

subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 1393d49e4baf90d99029e88bfcea954d92012474530570ceb83f33f2cd419a86

subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 1393d49e4baf90d99029e88bfcea954d92012474530570ceb83f33f2cd419a86

subscription-manager-debugsource-1.26.22-2.el8_2.x86_64.rpm

SHA-256: f5d4ad7f716b4e7b0f9786a80bce4038b9d0acae9893a879589d6e02bdfb0d80

subscription-manager-debugsource-1.26.22-2.el8_2.x86_64.rpm

SHA-256: f5d4ad7f716b4e7b0f9786a80bce4038b9d0acae9893a879589d6e02bdfb0d80

subscription-manager-initial-setup-addon-1.26.22-2.el8_2.x86_64.rpm

SHA-256: c3eac19dfad63919aeb8f2df6daa34aad45f9316696da162807e1d1092021ed4

subscription-manager-migration-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 92e636613d74d7e51d42f70091cbe8b29a5b37aa6dafac8cad2cace72ea5cc74

subscription-manager-plugin-ostree-1.26.22-2.el8_2.x86_64.rpm

SHA-256: e5e7a442b148ecd93d132e52ca933c4e143c72abae5ff7c7e87f1fe7a3d591a3

subscription-manager-rhsm-certificates-1.26.22-2.el8_2.x86_64.rpm

SHA-256: af51ed4fec617fc7980406e6677d52c72daf33eab91d247ff71ff2c8efb53f5b

Red Hat Enterprise Linux Server - TUS 8.2

SRPM

subscription-manager-1.26.22-2.el8_2.src.rpm

SHA-256: f11bd3a24a5e0fcc3095c16f94325648ee58ecfe99a876c7fb2e0f964615e3a9

x86_64

dnf-plugin-subscription-manager-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 2834511250db331cdbb5c7a74c2e21c3fb14e10682e8451a9c1aa167d46ac901

dnf-plugin-subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 03be1c427d23b5d7208a38ddb78c272758fd31832c76f67f8ba4caa988d44aaf

dnf-plugin-subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 03be1c427d23b5d7208a38ddb78c272758fd31832c76f67f8ba4caa988d44aaf

python3-subscription-manager-rhsm-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 52bae4b13cf663fc67f05c438a299d6ce0374aef19d8fed9848925ce94369570

python3-subscription-manager-rhsm-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 43f8ea229c5c4a7a1170ec4a94de3ff3399746051c004c15b3955d2cf35cd4d3

python3-subscription-manager-rhsm-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 43f8ea229c5c4a7a1170ec4a94de3ff3399746051c004c15b3955d2cf35cd4d3

python3-syspurpose-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 6eccc3cb8349cf1fd06c692d8995052932da468fb83e460c0c71700ce5e00991

rhsm-gtk-1.26.22-2.el8_2.x86_64.rpm

SHA-256: fcfb5f132b87e9aed3defc5a918301f9af0f9e8a83c20c545e1f797113b7f7d9

rhsm-icons-1.26.22-2.el8_2.noarch.rpm

SHA-256: 5ebe70b2e4b498b2ce586cbcad7c0f49050464821d125a2a4c4c3babb4f52452

subscription-manager-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 18d04da502e027dd39e70ed0775a0fcefdcd8e63c9ecc0df8ada5a6c9c7017d8

subscription-manager-cockpit-1.26.22-2.el8_2.noarch.rpm

SHA-256: e40321c1062e18c9f0ea5bf9be9c03953c69c2eefe0b452cfb5abf005228fb20

subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 1393d49e4baf90d99029e88bfcea954d92012474530570ceb83f33f2cd419a86

subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 1393d49e4baf90d99029e88bfcea954d92012474530570ceb83f33f2cd419a86

subscription-manager-debugsource-1.26.22-2.el8_2.x86_64.rpm

SHA-256: f5d4ad7f716b4e7b0f9786a80bce4038b9d0acae9893a879589d6e02bdfb0d80

subscription-manager-debugsource-1.26.22-2.el8_2.x86_64.rpm

SHA-256: f5d4ad7f716b4e7b0f9786a80bce4038b9d0acae9893a879589d6e02bdfb0d80

subscription-manager-initial-setup-addon-1.26.22-2.el8_2.x86_64.rpm

SHA-256: c3eac19dfad63919aeb8f2df6daa34aad45f9316696da162807e1d1092021ed4

subscription-manager-migration-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 92e636613d74d7e51d42f70091cbe8b29a5b37aa6dafac8cad2cace72ea5cc74

subscription-manager-plugin-ostree-1.26.22-2.el8_2.x86_64.rpm

SHA-256: e5e7a442b148ecd93d132e52ca933c4e143c72abae5ff7c7e87f1fe7a3d591a3

subscription-manager-rhsm-certificates-1.26.22-2.el8_2.x86_64.rpm

SHA-256: af51ed4fec617fc7980406e6677d52c72daf33eab91d247ff71ff2c8efb53f5b

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2

SRPM

subscription-manager-1.26.22-2.el8_2.src.rpm

SHA-256: f11bd3a24a5e0fcc3095c16f94325648ee58ecfe99a876c7fb2e0f964615e3a9

ppc64le

dnf-plugin-subscription-manager-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: 790043ca44002b6d7a54e167b531504a0dcfe7b9c72844096e241c842bc064c9

dnf-plugin-subscription-manager-debuginfo-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: a6a3482d90d4f2a2cbe34ff85354cffdb58db8d558cb82f458605a55413abbdd

dnf-plugin-subscription-manager-debuginfo-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: a6a3482d90d4f2a2cbe34ff85354cffdb58db8d558cb82f458605a55413abbdd

python3-subscription-manager-rhsm-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: cc0536fd0069937ceb9fb795c9e8b7f9a6d551397b9d6c16b33f57474fb27af2

python3-subscription-manager-rhsm-debuginfo-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: 2b1df48fd428c1e496916ff168e402f2013eb07855d2fc94b6f350d65f8354e3

python3-subscription-manager-rhsm-debuginfo-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: 2b1df48fd428c1e496916ff168e402f2013eb07855d2fc94b6f350d65f8354e3

python3-syspurpose-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: a92cfc3e8c5d45c3fec2debeb4bcf002e2d31231a59dcedab2a1b5e5f0dfc638

rhsm-gtk-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: 3e0d408d258b93c749a5727967eaabbc9f89c5ad7fe8d412c505c95185ce200f

rhsm-icons-1.26.22-2.el8_2.noarch.rpm

SHA-256: 5ebe70b2e4b498b2ce586cbcad7c0f49050464821d125a2a4c4c3babb4f52452

subscription-manager-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: 5c9992c164682d2297cbc26eff97103f089864b51a6de941967be75472831d75

subscription-manager-cockpit-1.26.22-2.el8_2.noarch.rpm

SHA-256: e40321c1062e18c9f0ea5bf9be9c03953c69c2eefe0b452cfb5abf005228fb20

subscription-manager-debuginfo-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: 55bb00d6dcd3cb1b060252640ccc5acc9fd8d4b5e983e6ed7c764fab85271f2f

subscription-manager-debuginfo-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: 55bb00d6dcd3cb1b060252640ccc5acc9fd8d4b5e983e6ed7c764fab85271f2f

subscription-manager-debugsource-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: 39b8f9f63059fb6958a48c818035e24c1bcb2bfdf0ec5e84d45593dc043d2fc9

subscription-manager-debugsource-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: 39b8f9f63059fb6958a48c818035e24c1bcb2bfdf0ec5e84d45593dc043d2fc9

subscription-manager-initial-setup-addon-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: 463f05178876fbce64b1f8078aff7ec5491f340fd795026eebfab272476b58a1

subscription-manager-migration-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: a1516b4ec96dd6235ceaa851149070d885be2fef12110b94f82f9a4f6c2aec3b

subscription-manager-plugin-ostree-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: e461307088da303cb9358f90a0476924f99897132fef97c82e044abf6933bbac

subscription-manager-rhsm-certificates-1.26.22-2.el8_2.ppc64le.rpm

SHA-256: aadde394167be4737ed9705da365f430df8e23828241654b235a4aa46a5fa7a4

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2

SRPM

subscription-manager-1.26.22-2.el8_2.src.rpm

SHA-256: f11bd3a24a5e0fcc3095c16f94325648ee58ecfe99a876c7fb2e0f964615e3a9

x86_64

dnf-plugin-subscription-manager-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 2834511250db331cdbb5c7a74c2e21c3fb14e10682e8451a9c1aa167d46ac901

dnf-plugin-subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 03be1c427d23b5d7208a38ddb78c272758fd31832c76f67f8ba4caa988d44aaf

dnf-plugin-subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 03be1c427d23b5d7208a38ddb78c272758fd31832c76f67f8ba4caa988d44aaf

python3-subscription-manager-rhsm-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 52bae4b13cf663fc67f05c438a299d6ce0374aef19d8fed9848925ce94369570

python3-subscription-manager-rhsm-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 43f8ea229c5c4a7a1170ec4a94de3ff3399746051c004c15b3955d2cf35cd4d3

python3-subscription-manager-rhsm-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 43f8ea229c5c4a7a1170ec4a94de3ff3399746051c004c15b3955d2cf35cd4d3

python3-syspurpose-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 6eccc3cb8349cf1fd06c692d8995052932da468fb83e460c0c71700ce5e00991

rhsm-gtk-1.26.22-2.el8_2.x86_64.rpm

SHA-256: fcfb5f132b87e9aed3defc5a918301f9af0f9e8a83c20c545e1f797113b7f7d9

rhsm-icons-1.26.22-2.el8_2.noarch.rpm

SHA-256: 5ebe70b2e4b498b2ce586cbcad7c0f49050464821d125a2a4c4c3babb4f52452

subscription-manager-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 18d04da502e027dd39e70ed0775a0fcefdcd8e63c9ecc0df8ada5a6c9c7017d8

subscription-manager-cockpit-1.26.22-2.el8_2.noarch.rpm

SHA-256: e40321c1062e18c9f0ea5bf9be9c03953c69c2eefe0b452cfb5abf005228fb20

subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 1393d49e4baf90d99029e88bfcea954d92012474530570ceb83f33f2cd419a86

subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 1393d49e4baf90d99029e88bfcea954d92012474530570ceb83f33f2cd419a86

subscription-manager-debugsource-1.26.22-2.el8_2.x86_64.rpm

SHA-256: f5d4ad7f716b4e7b0f9786a80bce4038b9d0acae9893a879589d6e02bdfb0d80

subscription-manager-debugsource-1.26.22-2.el8_2.x86_64.rpm

SHA-256: f5d4ad7f716b4e7b0f9786a80bce4038b9d0acae9893a879589d6e02bdfb0d80

subscription-manager-initial-setup-addon-1.26.22-2.el8_2.x86_64.rpm

SHA-256: c3eac19dfad63919aeb8f2df6daa34aad45f9316696da162807e1d1092021ed4

subscription-manager-migration-1.26.22-2.el8_2.x86_64.rpm

SHA-256: 92e636613d74d7e51d42f70091cbe8b29a5b37aa6dafac8cad2cace72ea5cc74

subscription-manager-plugin-ostree-1.26.22-2.el8_2.x86_64.rpm

SHA-256: e5e7a442b148ecd93d132e52ca933c4e143c72abae5ff7c7e87f1fe7a3d591a3

subscription-manager-rhsm-certificates-1.26.22-2.el8_2.x86_64.rpm

SHA-256: af51ed4fec617fc7980406e6677d52c72daf33eab91d247ff71ff2c8efb53f5b

The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.

Related news

Red Hat Security Advisory 2023-5421-01

Red Hat Security Advisory 2023-5421-01 - Multicluster Engine for Kubernetes 2.3.2 images Multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.

Red Hat Security Advisory 2023-5376-01

Red Hat Security Advisory 2023-5376-01 - Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include a denial of service vulnerability.

RHSA-2023:5095: Red Hat Security Advisory: Logging Subsystem 5.6.11 - Red Hat OpenShift security update

Logging Subsystem 5.6.11 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-4456: A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.

RHSA-2023:5233: Red Hat Security Advisory: OpenShift Virtualization 4.13.4 security and bug fix update

Red Hat OpenShift Virtualization release 4.13.4 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-41723: A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of requests.

RHSA-2023:5174: Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.4.3 security update

Red Hat OpenShift Service Mesh Containers for 2.4.3 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-35942: A flaw was found in Envoy, where gRPC access loggers using the listener's global scope can cause a use-after-free crash when the listener is drained. This issue can be triggered by a listener discovery service (LDS) update with the same gRPC access log configuration.

Red Hat Security Advisory 2023-5001-01

Red Hat Security Advisory 2023-5001-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.11.49. Issues addressed include a bypass vulnerability.

Red Hat Security Advisory 2023-5103-01

Red Hat Security Advisory 2023-5103-01 - OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization 4.11.6 images.

RHSA-2023:5029: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

An update is now available for Red Hat OpenShift GitOps 1.9. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-40029: A flaw was found in the ArgoCD package, used by Red Hat GitOps, that allows cluster secrets to be managed declaratively using the `kubectl apply` functionality, resulting in the full secret body being stored in `kubectl.kubernetes.io/last-applied-configuration` annotation. Since ArgoCD has included the ability to manage cluster labels and annotations via i...

Red Hat Security Advisory 2023-4730-01

Red Hat Security Advisory 2023-4730-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.10.

Red Hat Security Advisory 2023-4875-01

Red Hat Security Advisory 2023-4875-01 - Red Hat Advanced Cluster Management for Kubernetes 2.8.1 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which provide security updates and fix several bugs. Issues addressed include bypass and privilege escalation vulnerabilities.

Red Hat Security Advisory 2023-4706-01

Red Hat Security Advisory 2023-4706-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.

Red Hat Security Advisory 2023-4705-01

Red Hat Security Advisory 2023-4705-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.

Red Hat Security Advisory 2023-4702-01

Red Hat Security Advisory 2023-4702-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.

Red Hat Security Advisory 2023-4701-01

Red Hat Security Advisory 2023-4701-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.

Red Hat Security Advisory 2023-4707-01

Red Hat Security Advisory 2023-4707-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.

Red Hat Security Advisory 2023-4704-01

Red Hat Security Advisory 2023-4704-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.

CVE-2023-3899

A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.

RHSA-2023:4705: Red Hat Security Advisory: subscription-manager security update

An update for subscription-manager is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() me...

RHSA-2023:4708: Red Hat Security Advisory: subscription-manager security update

An update for subscription-manager is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged loc...

RHSA-2023:4707: Red Hat Security Advisory: subscription-manager security update

An update for subscription-manager is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() me...

RHSA-2023:4701: Red Hat Security Advisory: subscription-manager security update

An update for subscription-manager is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged loca...

RHSA-2023:4702: Red Hat Security Advisory: subscription-manager security update

An update for subscription-manager is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.S...