Redhat Subscription Manager vulnerabilities

3 vulnerabilities

Known vulnerabilities in Redhat Subscription Manager, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

3.3CVE-2016-4455redhatenterprise_linux_desktop+16
EPSS score
0.43%
The Subscription Manager package (aka subscription-manager) before 1.17.7-1 for Candlepin uses weak permissions (755) for subscription-manager cache directories, which allows local users to obtain sensitive information by reading files in the directories.8.2CVE-2017-2663red hatsubscription-manager+1
EPSS score
0.36%
It was found that subscription-manager's DBus interface before 1.19.4 let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and com.redhat.RHSM1.Config.Set methods. An unprivileged local attacker could use these methods to gain access to private information, or launch a privilege escalation attack.7.8CVE-2023-3899fedoraprojectfedora+41
EPSS score
0.24%
A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.