Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

RedHat: RHSA-2023-0987-01 moderate: subscription-manager Info Leak Alert

red hat
Calendar Grey November 3, 2016
Scroller Redhat
Mild RedHat security bulletin for subscription-manager resolves data leakage through inadequate file permissions.
An update for subscription-manager, subscription-manager-migration-data, and python-rhsm is now available for Red Hat Enterprise Linux 7

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.
The subscription-manager-migration-data package provides certificates for migrating a system from the legacy Red Hat Network Classic (RHN) to Red Hat Subscription Management (RHSM).
The python-rhsm packages provide a library for communicating with the representational state transfer (REST) interface of a Red Hat Unified Entitlement Platform. The Subscription Management tools use this interface to manage system entitlements, certificates, and access to content.
The following packages have been upgraded to a newer upstream version: subscription-manager (1.17.15), python-rhsm (1.17.9), subscription-manager-migration-data (2.0.31). (BZ#1328553, BZ#1328555, BZ#1328559)
Security Fix(es):
* It was found that subscription-manager set weak permissions on files in /var/lib/rhsm/, causing an information disclosure. A local, unprivileged user could use this flaw to access sensitive data that could potentially be used in a social engineering attack. (CVE-2016-4455)
Red Hat would like to thank Robert Scheck for reporting this issue.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory security update Red Hat moderate severity information disclosure subscription-manager

References

https://access.redhat.com/security/cve/CVE-2016-4455 https://access.redhat.com/security/updates/classification#moderate https://docs.redhat.com/en/documentation/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html

Package List

Red Hat Enterprise Linux Client (v. 7):
Source: python-rhsm-1.17.9-1.el7.src.rpm subscription-manager-1.17.15-1.el7.src.rpm subscription-manager-migration-data-2.0.31-1.el7.src.rpm
noarch: subscription-manager-migration-data-2.0.31-1.el7.noarch.rpm
x86_64: python-rhsm-1.17.9-1.el7.x86_64.rpm python-rhsm-certificates-1.17.9-1.el7.x86_64.rpm python-rhsm-debuginfo-1.17.9-1.el7.x86_64.rpm subscription-manager-1.17.15-1.el7.x86_64.rpm subscription-manager-debuginfo-1.17.15-1.el7.x86_64.rpm subscription-manager-gui-1.17.15-1.el7.x86_64.rpm subscription-manager-initial-setup-addon-1.17.15-1.el7.x86_64.rpm subscription-manager-migration-1.17.15-1.el7.x86_64.rpm subscription-manager-plugin-container-1.17.15-1.el7.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64: subscription-manager-debuginfo-1.17.15-1.el7.x86_64.rpm subscription-manager-plugin-ostree-1.17.15-1.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source: python-rhsm-1.17.9-1.el7.src.rpm subscription-manager-1.17.15-1.el7.src.rpm subscription-manager-migration-data-2.0.31-1.el7.src.rpm
noarch: subscription-manager-migration-data-2.0.31-1.el7.noarch.rpm
x86_64: python-rhsm-1.17.9-1.el7.x86_64.rpm python-rhsm-certificates-1.17.9-1.el7.x86_64.rpm python-rhsm-debuginfo-1.17.9-1.el7.x86_64.rpm

Read the Full Advisory


Advisory ID: RHSA-2016:2592-02
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2016:2592.html
Issue date: 2016-11-03

Topic

An update for subscription-manager, subscription-manager-migration-data,and python-rhsm is now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory security update Red Hat moderate severity information disclosure subscription-manager

Relevant Releases Architectures

Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64

Red Hat Enterprise Linux Client Optional (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64

Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64

Red Hat Enterprise Linux Server (v. 7) - aarch64, noarch, ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64

Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

Bugs Fixed

874735 - [RFE] Network interface collection/facts do not support multiple address per interface

1104332 - [RFE] Separate out the rhsm certs into a separate RPM

1251516 - traceback on removing an import cert from 'my subs in gui'

1257179 - subscription-manager-initial-setup-addon - "Cancel" button does nothing

1262919 - exceptions from connection.RestlibException during autosubscribe should be printed to system error

1264108 - the red warning message in subscription-manager-initial-setup-addon should disappear when clicking Cancel/Back

1264470 - various RHEL7 channel maps to product certs are missing in subscription-manager-migration-data

1264964 - subscription-manager package profile submission is sending profiles with UUID=None to SLE endpoint

1268043 - Back button on first panel of subscription-manager-gui workflow has no effect

1268094 - Traceback in subscription-manager-gui from My Subscriptions Tab

1268307 - At the end of auto attach, the Back button does nothing

1306004 - The cmd "repos --list --proxy" with a fake proxy server url will not stop running.

1315901 - Stacktrace displayed when running rct against an inaccessible file

1325083 - Available subscriptions can not be sorted by number in subscription-manager-gui

1328553 - Rebase subscription-manager component to the latest upstream branch for RHEL 7.3

1328555 - Rebase python-rhsm component to the latest upstream branch for RHEL 7.3

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.