Headline
RHSA-2023:4703: Red Hat Security Advisory: subscription-manager security update
An update for subscription-manager is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
Skip to navigation Skip to main content
Utilities
- Subscriptions
- Downloads
- Containers
- Support Cases
Infrastructure and Management
- Red Hat Enterprise Linux
- Red Hat Satellite
- Red Hat Subscription Management
- Red Hat Insights
- Red Hat Ansible Automation Platform
Cloud Computing
- Red Hat OpenShift
- Red Hat OpenStack Platform
- Red Hat OpenShift Container Platform
- Red Hat OpenShift Data Science
- Red Hat OpenShift Dedicated
- Red Hat Advanced Cluster Security for Kubernetes
- Red Hat Advanced Cluster Management for Kubernetes
- Red Hat Quay
- Red Hat CodeReady Workspaces
- Red Hat OpenShift Service on AWS
Storage
- Red Hat Gluster Storage
- Red Hat Hyperconverged Infrastructure
- Red Hat Ceph Storage
- Red Hat OpenShift Data Foundation
Runtimes
- Red Hat Runtimes
- Red Hat JBoss Enterprise Application Platform
- Red Hat Data Grid
- Red Hat JBoss Web Server
- Red Hat Single Sign On
- Red Hat support for Spring Boot
- Red Hat build of Node.js
- Red Hat build of Quarkus
Integration and Automation
All Products
Issued:
2023-08-22
Updated:
2023-08-22
RHSA-2023:4703 - Security Advisory
- Overview
- Updated Packages
Synopsis
Important: subscription-manager security update
Type/Severity
Security Advisory: Important
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update for subscription-manager is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
Security Fix(es):
- subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration (CVE-2023-3899)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Products
- Red Hat Enterprise Linux Server - AUS 8.2 x86_64
- Red Hat Enterprise Linux Server - TUS 8.2 x86_64
- Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2 ppc64le
- Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2 x86_64
Fixes
- BZ - 2225407 - CVE-2023-3899 subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration
Red Hat Enterprise Linux Server - AUS 8.2
SRPM
subscription-manager-1.26.22-2.el8_2.src.rpm
SHA-256: f11bd3a24a5e0fcc3095c16f94325648ee58ecfe99a876c7fb2e0f964615e3a9
x86_64
dnf-plugin-subscription-manager-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 2834511250db331cdbb5c7a74c2e21c3fb14e10682e8451a9c1aa167d46ac901
dnf-plugin-subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 03be1c427d23b5d7208a38ddb78c272758fd31832c76f67f8ba4caa988d44aaf
dnf-plugin-subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 03be1c427d23b5d7208a38ddb78c272758fd31832c76f67f8ba4caa988d44aaf
python3-subscription-manager-rhsm-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 52bae4b13cf663fc67f05c438a299d6ce0374aef19d8fed9848925ce94369570
python3-subscription-manager-rhsm-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 43f8ea229c5c4a7a1170ec4a94de3ff3399746051c004c15b3955d2cf35cd4d3
python3-subscription-manager-rhsm-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 43f8ea229c5c4a7a1170ec4a94de3ff3399746051c004c15b3955d2cf35cd4d3
python3-syspurpose-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 6eccc3cb8349cf1fd06c692d8995052932da468fb83e460c0c71700ce5e00991
rhsm-gtk-1.26.22-2.el8_2.x86_64.rpm
SHA-256: fcfb5f132b87e9aed3defc5a918301f9af0f9e8a83c20c545e1f797113b7f7d9
rhsm-icons-1.26.22-2.el8_2.noarch.rpm
SHA-256: 5ebe70b2e4b498b2ce586cbcad7c0f49050464821d125a2a4c4c3babb4f52452
subscription-manager-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 18d04da502e027dd39e70ed0775a0fcefdcd8e63c9ecc0df8ada5a6c9c7017d8
subscription-manager-cockpit-1.26.22-2.el8_2.noarch.rpm
SHA-256: e40321c1062e18c9f0ea5bf9be9c03953c69c2eefe0b452cfb5abf005228fb20
subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 1393d49e4baf90d99029e88bfcea954d92012474530570ceb83f33f2cd419a86
subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 1393d49e4baf90d99029e88bfcea954d92012474530570ceb83f33f2cd419a86
subscription-manager-debugsource-1.26.22-2.el8_2.x86_64.rpm
SHA-256: f5d4ad7f716b4e7b0f9786a80bce4038b9d0acae9893a879589d6e02bdfb0d80
subscription-manager-debugsource-1.26.22-2.el8_2.x86_64.rpm
SHA-256: f5d4ad7f716b4e7b0f9786a80bce4038b9d0acae9893a879589d6e02bdfb0d80
subscription-manager-initial-setup-addon-1.26.22-2.el8_2.x86_64.rpm
SHA-256: c3eac19dfad63919aeb8f2df6daa34aad45f9316696da162807e1d1092021ed4
subscription-manager-migration-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 92e636613d74d7e51d42f70091cbe8b29a5b37aa6dafac8cad2cace72ea5cc74
subscription-manager-plugin-ostree-1.26.22-2.el8_2.x86_64.rpm
SHA-256: e5e7a442b148ecd93d132e52ca933c4e143c72abae5ff7c7e87f1fe7a3d591a3
subscription-manager-rhsm-certificates-1.26.22-2.el8_2.x86_64.rpm
SHA-256: af51ed4fec617fc7980406e6677d52c72daf33eab91d247ff71ff2c8efb53f5b
Red Hat Enterprise Linux Server - TUS 8.2
SRPM
subscription-manager-1.26.22-2.el8_2.src.rpm
SHA-256: f11bd3a24a5e0fcc3095c16f94325648ee58ecfe99a876c7fb2e0f964615e3a9
x86_64
dnf-plugin-subscription-manager-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 2834511250db331cdbb5c7a74c2e21c3fb14e10682e8451a9c1aa167d46ac901
dnf-plugin-subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 03be1c427d23b5d7208a38ddb78c272758fd31832c76f67f8ba4caa988d44aaf
dnf-plugin-subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 03be1c427d23b5d7208a38ddb78c272758fd31832c76f67f8ba4caa988d44aaf
python3-subscription-manager-rhsm-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 52bae4b13cf663fc67f05c438a299d6ce0374aef19d8fed9848925ce94369570
python3-subscription-manager-rhsm-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 43f8ea229c5c4a7a1170ec4a94de3ff3399746051c004c15b3955d2cf35cd4d3
python3-subscription-manager-rhsm-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 43f8ea229c5c4a7a1170ec4a94de3ff3399746051c004c15b3955d2cf35cd4d3
python3-syspurpose-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 6eccc3cb8349cf1fd06c692d8995052932da468fb83e460c0c71700ce5e00991
rhsm-gtk-1.26.22-2.el8_2.x86_64.rpm
SHA-256: fcfb5f132b87e9aed3defc5a918301f9af0f9e8a83c20c545e1f797113b7f7d9
rhsm-icons-1.26.22-2.el8_2.noarch.rpm
SHA-256: 5ebe70b2e4b498b2ce586cbcad7c0f49050464821d125a2a4c4c3babb4f52452
subscription-manager-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 18d04da502e027dd39e70ed0775a0fcefdcd8e63c9ecc0df8ada5a6c9c7017d8
subscription-manager-cockpit-1.26.22-2.el8_2.noarch.rpm
SHA-256: e40321c1062e18c9f0ea5bf9be9c03953c69c2eefe0b452cfb5abf005228fb20
subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 1393d49e4baf90d99029e88bfcea954d92012474530570ceb83f33f2cd419a86
subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 1393d49e4baf90d99029e88bfcea954d92012474530570ceb83f33f2cd419a86
subscription-manager-debugsource-1.26.22-2.el8_2.x86_64.rpm
SHA-256: f5d4ad7f716b4e7b0f9786a80bce4038b9d0acae9893a879589d6e02bdfb0d80
subscription-manager-debugsource-1.26.22-2.el8_2.x86_64.rpm
SHA-256: f5d4ad7f716b4e7b0f9786a80bce4038b9d0acae9893a879589d6e02bdfb0d80
subscription-manager-initial-setup-addon-1.26.22-2.el8_2.x86_64.rpm
SHA-256: c3eac19dfad63919aeb8f2df6daa34aad45f9316696da162807e1d1092021ed4
subscription-manager-migration-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 92e636613d74d7e51d42f70091cbe8b29a5b37aa6dafac8cad2cace72ea5cc74
subscription-manager-plugin-ostree-1.26.22-2.el8_2.x86_64.rpm
SHA-256: e5e7a442b148ecd93d132e52ca933c4e143c72abae5ff7c7e87f1fe7a3d591a3
subscription-manager-rhsm-certificates-1.26.22-2.el8_2.x86_64.rpm
SHA-256: af51ed4fec617fc7980406e6677d52c72daf33eab91d247ff71ff2c8efb53f5b
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2
SRPM
subscription-manager-1.26.22-2.el8_2.src.rpm
SHA-256: f11bd3a24a5e0fcc3095c16f94325648ee58ecfe99a876c7fb2e0f964615e3a9
ppc64le
dnf-plugin-subscription-manager-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: 790043ca44002b6d7a54e167b531504a0dcfe7b9c72844096e241c842bc064c9
dnf-plugin-subscription-manager-debuginfo-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: a6a3482d90d4f2a2cbe34ff85354cffdb58db8d558cb82f458605a55413abbdd
dnf-plugin-subscription-manager-debuginfo-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: a6a3482d90d4f2a2cbe34ff85354cffdb58db8d558cb82f458605a55413abbdd
python3-subscription-manager-rhsm-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: cc0536fd0069937ceb9fb795c9e8b7f9a6d551397b9d6c16b33f57474fb27af2
python3-subscription-manager-rhsm-debuginfo-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: 2b1df48fd428c1e496916ff168e402f2013eb07855d2fc94b6f350d65f8354e3
python3-subscription-manager-rhsm-debuginfo-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: 2b1df48fd428c1e496916ff168e402f2013eb07855d2fc94b6f350d65f8354e3
python3-syspurpose-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: a92cfc3e8c5d45c3fec2debeb4bcf002e2d31231a59dcedab2a1b5e5f0dfc638
rhsm-gtk-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: 3e0d408d258b93c749a5727967eaabbc9f89c5ad7fe8d412c505c95185ce200f
rhsm-icons-1.26.22-2.el8_2.noarch.rpm
SHA-256: 5ebe70b2e4b498b2ce586cbcad7c0f49050464821d125a2a4c4c3babb4f52452
subscription-manager-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: 5c9992c164682d2297cbc26eff97103f089864b51a6de941967be75472831d75
subscription-manager-cockpit-1.26.22-2.el8_2.noarch.rpm
SHA-256: e40321c1062e18c9f0ea5bf9be9c03953c69c2eefe0b452cfb5abf005228fb20
subscription-manager-debuginfo-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: 55bb00d6dcd3cb1b060252640ccc5acc9fd8d4b5e983e6ed7c764fab85271f2f
subscription-manager-debuginfo-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: 55bb00d6dcd3cb1b060252640ccc5acc9fd8d4b5e983e6ed7c764fab85271f2f
subscription-manager-debugsource-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: 39b8f9f63059fb6958a48c818035e24c1bcb2bfdf0ec5e84d45593dc043d2fc9
subscription-manager-debugsource-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: 39b8f9f63059fb6958a48c818035e24c1bcb2bfdf0ec5e84d45593dc043d2fc9
subscription-manager-initial-setup-addon-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: 463f05178876fbce64b1f8078aff7ec5491f340fd795026eebfab272476b58a1
subscription-manager-migration-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: a1516b4ec96dd6235ceaa851149070d885be2fef12110b94f82f9a4f6c2aec3b
subscription-manager-plugin-ostree-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: e461307088da303cb9358f90a0476924f99897132fef97c82e044abf6933bbac
subscription-manager-rhsm-certificates-1.26.22-2.el8_2.ppc64le.rpm
SHA-256: aadde394167be4737ed9705da365f430df8e23828241654b235a4aa46a5fa7a4
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2
SRPM
subscription-manager-1.26.22-2.el8_2.src.rpm
SHA-256: f11bd3a24a5e0fcc3095c16f94325648ee58ecfe99a876c7fb2e0f964615e3a9
x86_64
dnf-plugin-subscription-manager-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 2834511250db331cdbb5c7a74c2e21c3fb14e10682e8451a9c1aa167d46ac901
dnf-plugin-subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 03be1c427d23b5d7208a38ddb78c272758fd31832c76f67f8ba4caa988d44aaf
dnf-plugin-subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 03be1c427d23b5d7208a38ddb78c272758fd31832c76f67f8ba4caa988d44aaf
python3-subscription-manager-rhsm-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 52bae4b13cf663fc67f05c438a299d6ce0374aef19d8fed9848925ce94369570
python3-subscription-manager-rhsm-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 43f8ea229c5c4a7a1170ec4a94de3ff3399746051c004c15b3955d2cf35cd4d3
python3-subscription-manager-rhsm-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 43f8ea229c5c4a7a1170ec4a94de3ff3399746051c004c15b3955d2cf35cd4d3
python3-syspurpose-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 6eccc3cb8349cf1fd06c692d8995052932da468fb83e460c0c71700ce5e00991
rhsm-gtk-1.26.22-2.el8_2.x86_64.rpm
SHA-256: fcfb5f132b87e9aed3defc5a918301f9af0f9e8a83c20c545e1f797113b7f7d9
rhsm-icons-1.26.22-2.el8_2.noarch.rpm
SHA-256: 5ebe70b2e4b498b2ce586cbcad7c0f49050464821d125a2a4c4c3babb4f52452
subscription-manager-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 18d04da502e027dd39e70ed0775a0fcefdcd8e63c9ecc0df8ada5a6c9c7017d8
subscription-manager-cockpit-1.26.22-2.el8_2.noarch.rpm
SHA-256: e40321c1062e18c9f0ea5bf9be9c03953c69c2eefe0b452cfb5abf005228fb20
subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 1393d49e4baf90d99029e88bfcea954d92012474530570ceb83f33f2cd419a86
subscription-manager-debuginfo-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 1393d49e4baf90d99029e88bfcea954d92012474530570ceb83f33f2cd419a86
subscription-manager-debugsource-1.26.22-2.el8_2.x86_64.rpm
SHA-256: f5d4ad7f716b4e7b0f9786a80bce4038b9d0acae9893a879589d6e02bdfb0d80
subscription-manager-debugsource-1.26.22-2.el8_2.x86_64.rpm
SHA-256: f5d4ad7f716b4e7b0f9786a80bce4038b9d0acae9893a879589d6e02bdfb0d80
subscription-manager-initial-setup-addon-1.26.22-2.el8_2.x86_64.rpm
SHA-256: c3eac19dfad63919aeb8f2df6daa34aad45f9316696da162807e1d1092021ed4
subscription-manager-migration-1.26.22-2.el8_2.x86_64.rpm
SHA-256: 92e636613d74d7e51d42f70091cbe8b29a5b37aa6dafac8cad2cace72ea5cc74
subscription-manager-plugin-ostree-1.26.22-2.el8_2.x86_64.rpm
SHA-256: e5e7a442b148ecd93d132e52ca933c4e143c72abae5ff7c7e87f1fe7a3d591a3
subscription-manager-rhsm-certificates-1.26.22-2.el8_2.x86_64.rpm
SHA-256: af51ed4fec617fc7980406e6677d52c72daf33eab91d247ff71ff2c8efb53f5b
The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.
Related news
Red Hat Security Advisory 2023-5421-01 - Multicluster Engine for Kubernetes 2.3.2 images Multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.
Red Hat Security Advisory 2023-5376-01 - Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include a denial of service vulnerability.
Logging Subsystem 5.6.11 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-4456: A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.
Red Hat OpenShift Virtualization release 4.13.4 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-41723: A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of requests.
Red Hat OpenShift Service Mesh Containers for 2.4.3 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-35942: A flaw was found in Envoy, where gRPC access loggers using the listener's global scope can cause a use-after-free crash when the listener is drained. This issue can be triggered by a listener discovery service (LDS) update with the same gRPC access log configuration.
Red Hat Security Advisory 2023-5001-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.11.49. Issues addressed include a bypass vulnerability.
Red Hat Security Advisory 2023-5103-01 - OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization 4.11.6 images.
An update is now available for Red Hat OpenShift GitOps 1.9. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-40029: A flaw was found in the ArgoCD package, used by Red Hat GitOps, that allows cluster secrets to be managed declaratively using the `kubectl apply` functionality, resulting in the full secret body being stored in `kubectl.kubernetes.io/last-applied-configuration` annotation. Since ArgoCD has included the ability to manage cluster labels and annotations via i...
Red Hat Security Advisory 2023-4730-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.10.
Red Hat Security Advisory 2023-4875-01 - Red Hat Advanced Cluster Management for Kubernetes 2.8.1 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which provide security updates and fix several bugs. Issues addressed include bypass and privilege escalation vulnerabilities.
Red Hat Security Advisory 2023-4706-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
Red Hat Security Advisory 2023-4705-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
Red Hat Security Advisory 2023-4702-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
Red Hat Security Advisory 2023-4701-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
Red Hat Security Advisory 2023-4707-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
Red Hat Security Advisory 2023-4704-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
An update for subscription-manager is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() me...
An update for subscription-manager is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged loc...
An update for subscription-manager is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() me...
An update for subscription-manager is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged loca...
An update for subscription-manager is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3899: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.S...