Skip to content
Fencer Vulns
high 7.8

CVE-2023-3899 json

Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

published 2023-08-23 3 y ago modified 2026-11-07 45 h ago also EUVD-2023-44525

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits
0
none known

Summary

A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 7 0:1.24.52-2.el7_9
  • Red Hat Red Hat Enterprise Linux 8 0:1.28.36-3.el8_8
  • Red Hat Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions 0:1.25.17.1-2.el8_1
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 0:1.26.22-2.el8_2
  • Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service 0:1.26.22-2.el8_2
  • Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions 0:1.26.22-2.el8_2
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:1.28.13-7.el8_4
  • Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service 0:1.28.13-7.el8_4
  • Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions 0:1.28.13-7.el8_4
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support 0:1.28.29.1-2.el8_6
  • Red Hat Red Hat Enterprise Linux 9 0:1.29.33.1-2.el9_2
  • Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support 0:1.29.26.2-2.el9_0
  • subscription-manager RHEL 7 1.24.52-2.el7_9
  • rhsm-gtk RHEL 7 1.24.52-2.el7_9
  • python-syspurpose RHEL 7 1.24.52-2.el7_9
  • subscription-manager-gui RHEL 7 1.24.52-2.el7_9
  • subscription-manager-rhsm RHEL 7 1.24.52-2.el7_9
  • subscription-manager-cockpit RHEL 7 1.24.52-2.el7_9
  • subscription-manager-migration RHEL 7 1.24.52-2.el7_9
  • subscription-manager-plugin-ostree RHEL 7 1.24.52-2.el7_9

red hat advisories RHSA-2023:4702RHSA-2023:4703RHSA-2023:4704RHSA-2023:4705RHSA-2023:4701RHSA-2023:4706

  • subscription-manager AlmaLinux 8 1.28.36-3.el8_8.alma.1
  • python3-cloud-what AlmaLinux 8 1.28.36-3.el8_8.alma.1
  • python3-syspurpose AlmaLinux 8 1.28.36-3.el8_8.alma.1
  • subscription-manager-migration AlmaLinux 8 1.28.36-3.el8_8.alma.1
  • dnf-plugin-subscription-manager AlmaLinux 8 1.28.36-3.el8_8.alma.1
  • python3-subscription-manager-rhsm AlmaLinux 8 1.28.36-3.el8_8.alma.1
  • subscription-manager-plugin-ostree AlmaLinux 8 1.28.36-3.el8_8.alma.1
  • subscription-manager-rhsm-certificates AlmaLinux 8 1.28.36-3.el8_8.alma.1

almalinux advisories ALSA-2023:4706ALSA-2023:4708

  • subscription-manager Rocky Linux 8 1.28.36-3.el8_8.rocky.0.1
  • subscription-manager Rocky Linux 9 1.29.33.1-2.el9_2.rocky.0.1

rocky linux advisories RLSA-2023:4706RLSA-2023:4708

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-3899 updated cvss 7.8

subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration

  • Red Hat Enterprise Linux AppStream (v. 8) rhsm-gtk 1.28.36-3.el8_8, subscription-manager-migration 1.28.36-3.el8_8, subscription-manager-initial-setup-addon 1.28.36-3.el8_8
    fixed: vendor fix RHSA-2023:4706
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) rhsm-gtk 1.26.22-2.el8_2, subscription-manager-migration 1.26.22-2.el8_2, subscription-manager-initial-setup-addon 1.26.22-2.el8_2
    fixed: vendor fix RHSA-2023:4703
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) rhsm-gtk 1.28.13-7.el8_4, subscription-manager-migration 1.28.13-7.el8_4, subscription-manager-initial-setup-addon 1.28.13-7.el8_4
    fixed: vendor fix RHSA-2023:4704
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) rhsm-gtk 1.25.17.1-2.el8_1, subscription-manager-migration 1.25.17.1-2.el8_1, subscription-manager-initial-setup-addon 1.25.17.1-2.el8_1
    fixed: vendor fix RHSA-2023:4702
  • Red Hat Enterprise Linux AppStream E4S (v. 8.2) rhsm-gtk 1.26.22-2.el8_2, subscription-manager-migration 1.26.22-2.el8_2, subscription-manager-initial-setup-addon 1.26.22-2.el8_2
    fixed: vendor fix RHSA-2023:4703
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) rhsm-gtk 1.28.13-7.el8_4, subscription-manager-migration 1.28.13-7.el8_4, subscription-manager-initial-setup-addon 1.28.13-7.el8_4
    fixed: vendor fix RHSA-2023:4704
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) rhsm-gtk 1.28.29.1-2.el8_6, subscription-manager-migration 1.28.29.1-2.el8_6, subscription-manager-initial-setup-addon 1.28.29.1-2.el8_6
    fixed: vendor fix RHSA-2023:4705
  • Red Hat Enterprise Linux AppStream TUS (v. 8.2) rhsm-gtk 1.26.22-2.el8_2, subscription-manager-migration 1.26.22-2.el8_2, subscription-manager-initial-setup-addon 1.26.22-2.el8_2
    fixed: vendor fix RHSA-2023:4703
show 14 more
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) rhsm-gtk 1.28.13-7.el8_4, subscription-manager-migration 1.28.13-7.el8_4, subscription-manager-initial-setup-addon 1.28.13-7.el8_4
    fixed: vendor fix RHSA-2023:4704
  • Red Hat Enterprise Linux BaseOS (v. 8) rhsm-icons 1.28.36-3.el8_8, python3-cloud-what 1.28.36-3.el8_8, python3-syspurpose 1.28.36-3.el8_8, subscription-manager 1.28.36-3.el8_8, subscription-manager-cockpit 1.28.36-3.el8_8, dnf-plugin-subscription-manager 1.28.36-3.el8_8, +3 more
    fixed: vendor fix RHSA-2023:4706
  • Red Hat Enterprise Linux BaseOS (v. 9) python3-cloud-what 1.29.33.1-2.el9_2, subscription-manager 1.29.33.1-2.el9_2, python3-subscription-manager-rhsm 1.29.33.1-2.el9_2, libdnf-plugin-subscription-manager 1.29.33.1-2.el9_2, subscription-manager-plugin-ostree 1.29.33.1-2.el9_2
    fixed: vendor fix RHSA-2023:4708
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) rhsm-icons 1.26.22-2.el8_2, python3-syspurpose 1.26.22-2.el8_2, subscription-manager 1.26.22-2.el8_2, subscription-manager-cockpit 1.26.22-2.el8_2, dnf-plugin-subscription-manager 1.26.22-2.el8_2, python3-subscription-manager-rhsm 1.26.22-2.el8_2, +2 more
    fixed: vendor fix RHSA-2023:4703
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) rhsm-icons 1.28.13-7.el8_4, python3-syspurpose 1.28.13-7.el8_4, subscription-manager 1.28.13-7.el8_4, subscription-manager-cockpit 1.28.13-7.el8_4, dnf-plugin-subscription-manager 1.28.13-7.el8_4, python3-subscription-manager-rhsm 1.28.13-7.el8_4, +2 more
    fixed: vendor fix RHSA-2023:4704
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.1) python3-syspurpose 1.25.17.1-2.el8_1, subscription-manager 1.25.17.1-2.el8_1, subscription-manager-cockpit 1.25.17.1-2.el8_1, dnf-plugin-subscription-manager 1.25.17.1-2.el8_1, python3-subscription-manager-rhsm 1.25.17.1-2.el8_1, subscription-manager-plugin-ostree 1.25.17.1-2.el8_1, +2 more
    fixed: vendor fix RHSA-2023:4702
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.2) rhsm-icons 1.26.22-2.el8_2, python3-syspurpose 1.26.22-2.el8_2, subscription-manager 1.26.22-2.el8_2, subscription-manager-cockpit 1.26.22-2.el8_2, dnf-plugin-subscription-manager 1.26.22-2.el8_2, python3-subscription-manager-rhsm 1.26.22-2.el8_2, +2 more
    fixed: vendor fix RHSA-2023:4703
  • Red Hat Enterprise Linux BaseOS E4S (v.8.4) rhsm-icons 1.28.13-7.el8_4, python3-syspurpose 1.28.13-7.el8_4, subscription-manager 1.28.13-7.el8_4, subscription-manager-cockpit 1.28.13-7.el8_4, dnf-plugin-subscription-manager 1.28.13-7.el8_4, python3-subscription-manager-rhsm 1.28.13-7.el8_4, +2 more
    fixed: vendor fix RHSA-2023:4704
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) rhsm-icons 1.28.29.1-2.el8_6, python3-cloud-what 1.28.29.1-2.el8_6, python3-syspurpose 1.28.29.1-2.el8_6, subscription-manager 1.28.29.1-2.el8_6, subscription-manager-cockpit 1.28.29.1-2.el8_6, dnf-plugin-subscription-manager 1.28.29.1-2.el8_6, +3 more
    fixed: vendor fix RHSA-2023:4705
  • Red Hat Enterprise Linux BaseOS EUS (v.9.0) rhsm-icons 1.29.26.2-2.el9_0, python3-cloud-what 1.29.26.2-2.el9_0, subscription-manager 1.29.26.2-2.el9_0, subscription-manager-cockpit 1.29.26.2-2.el9_0, python3-subscription-manager-rhsm 1.29.26.2-2.el9_0, libdnf-plugin-subscription-manager 1.29.26.2-2.el9_0, +2 more
    fixed: vendor fix RHSA-2023:4707
  • Red Hat Enterprise Linux BaseOS TUS (v. 8.2) rhsm-icons 1.26.22-2.el8_2, python3-syspurpose 1.26.22-2.el8_2, subscription-manager 1.26.22-2.el8_2, subscription-manager-cockpit 1.26.22-2.el8_2, dnf-plugin-subscription-manager 1.26.22-2.el8_2, python3-subscription-manager-rhsm 1.26.22-2.el8_2, +2 more
    fixed: vendor fix RHSA-2023:4703
  • Red Hat Enterprise Linux BaseOS TUS (v.8.4) rhsm-icons 1.28.13-7.el8_4, python3-syspurpose 1.28.13-7.el8_4, subscription-manager 1.28.13-7.el8_4, subscription-manager-cockpit 1.28.13-7.el8_4, dnf-plugin-subscription-manager 1.28.13-7.el8_4, python3-subscription-manager-rhsm 1.28.13-7.el8_4, +2 more
    fixed: vendor fix RHSA-2023:4704
  • Red Hat Enterprise Linux Client (v. 7) rhsm-gtk 1.24.52-2.el7_9, python-syspurpose 1.24.52-2.el7_9, subscription-manager 1.24.52-2.el7_9, subscription-manager-gui 1.24.52-2.el7_9, subscription-manager-rhsm 1.24.52-2.el7_9, subscription-manager-migration 1.24.52-2.el7_9, +3 more Red Hat Enterprise Linux Client Optional (v. 7) subscription-manager-cockpit 1.24.52-2.el7_9, subscription-manager-plugin-ostree 1.24.52-2.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) rhsm-gtk 1.24.52-2.el7_9, subscription-manager-gui 1.24.52-2.el7_9, subscription-manager-cockpit 1.24.52-2.el7_9, subscription-manager-plugin-ostree 1.24.52-2.el7_9, subscription-manager-initial-setup-addon 1.24.52-2.el7_9 Red Hat Enterprise Linux Server (v. 7) rhsm-gtk 1.24.52-2.el7_9, python-syspurpose 1.24.52-2.el7_9, subscription-manager 1.24.52-2.el7_9, subscription-manager-gui 1.24.52-2.el7_9, subscription-manager-rhsm 1.24.52-2.el7_9, subscription-manager-migration 1.24.52-2.el7_9, +3 more Red Hat Enterprise Linux Server Optional (v. 7) subscription-manager-cockpit 1.24.52-2.el7_9, subscription-manager-plugin-ostree 1.24.52-2.el7_9 Red Hat Enterprise Linux Workstation (v. 7) rhsm-gtk 1.24.52-2.el7_9, python-syspurpose 1.24.52-2.el7_9, subscription-manager 1.24.52-2.el7_9, subscription-manager-gui 1.24.52-2.el7_9, subscription-manager-rhsm 1.24.52-2.el7_9, subscription-manager-migration 1.24.52-2.el7_9, +3 more
    +1 more products
    Red Hat Enterprise Linux Workstation Optional (v. 7) subscription-manager-cockpit 1.24.52-2.el7_9, subscription-manager-plugin-ostree 1.24.52-2.el7_9
    fixed: vendor fix RHSA-2023:4701
  • Red Hat Enterprise Linux 6 subscription-manager, subscription-manager-gui, subscription-manager-firstboot, subscription-manager-migration, subscription-manager-plugin-container
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.