Description (CNA)
It was found that subscription-manager's DBus interface before 1.19.4 let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and com.redhat.RHSM1.Config.Set methods. An unprivileged local attacker could use these methods to gain access to private information, or launch a privilege escalation attack.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / subscription-manager | affected 1.19.4 |
CWE
CWE-270
References
- http://www.securityfocus.com/bid/97015
- https://github.com/candlepin/subscription-manager/commit/2aa48ef65
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2663
ADP enrichment
No English description supplied.