Skip to content
Fencer Vulns
high 7.8

CVE-2023-3972 json

Insights-client: unsafe handling of temporary files and directories

published 2023-11-01 3 y ago modified 2026-11-07 45 h ago also EUVD-2023-44597

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local user or attacker could create the /var/tmp/insights-client directory (owning the directory with read, write, and execute permissions) on the system. After the insights-client is registered by root, an attacker could then control the directory content that insights are using by putting malicious scripts into it and executing arbitrary code as root (trivially bypassing SELinux protections because insights processes are allowed to disable SELinux system-wide).

Patch / fix

  • Red Hat Red Hat Enterprise Linux 7 0:3.1.9-1.el7_9
  • Red Hat Red Hat Enterprise Linux 8 0:3.2.2-1.el8_8
  • Red Hat Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions 0:3.2.3-1.el8_1
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 0:3.2.3-1.el8_2
  • Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service 0:3.2.3-1.el8_2
  • Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions 0:3.2.3-1.el8_2
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:3.2.3-1.el8_4
  • Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service 0:3.2.3-1.el8_4
  • Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions 0:3.2.3-1.el8_4
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support 0:3.2.2-1.el8_6
  • Red Hat Red Hat Enterprise Linux 9 0:3.2.2-1.el9_2
  • Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support 0:3.2.2-1.el9_0
  • insights-client RHEL 9 3.2.2-1.el9_2
  • insights-client RHEL 7 3.1.9-1.el7_9
  • insights-client RHEL 8 3.2.2-1.el8_8
  • insights-client RHEL 8.4 TUS, RHEL 8.4 E4S, RHEL 8.4 AUS 3.2.3-1.el8_4
  • insights-client RHEL 9.0 EUS 3.2.2-1.el9_0
  • insights-client RHEL 8.1 E4S 3.2.3-1.el8_1
  • insights-client RHEL 8.2 TUS, RHEL 8.2 E4S, RHEL 8.2 AUS 3.2.3-1.el8_2
  • insights-client RHEL 8.6 EUS 3.2.2-1.el8_6

red hat advisories RHSA-2023:6282RHSA-2023:6798RHSA-2023:6796RHSA-2023:6795RHSA-2023:6811RHSA-2023:6283

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-3972 updated cvss 7.8

insights-client: unsafe handling of temporary files and directories

  • Red Hat Enterprise Linux 6 insights-client
    affected: workaround, no fix planned “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
  • Red Hat Enterprise Linux AppStream (v. 8) insights-client 3.2.2-1.el8_8
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:6283
  • Red Hat Enterprise Linux AppStream (v. 9) insights-client 3.2.2-1.el9_2
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:6282
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) insights-client 3.2.3-1.el8_2
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:6264
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) insights-client 3.2.3-1.el8_4
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:6798
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) insights-client 3.2.3-1.el8_1
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:6811
  • Red Hat Enterprise Linux AppStream E4S (v. 8.2) insights-client 3.2.3-1.el8_2
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:6264
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) insights-client 3.2.3-1.el8_4
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:6798
show 5 more
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) insights-client 3.2.2-1.el8_6
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:6284
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) insights-client 3.2.2-1.el9_0
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:6796
  • Red Hat Enterprise Linux AppStream TUS (v. 8.2) insights-client 3.2.3-1.el8_2
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:6264
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) insights-client 3.2.3-1.el8_4
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:6798
  • Red Hat Enterprise Linux Client (v. 7) insights-client 3.1.9-1.el7_9 Red Hat Enterprise Linux Server (v. 7) insights-client 3.1.9-1.el7_9 Red Hat Enterprise Linux Workstation (v. 7) insights-client 3.1.9-1.el7_9
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2023:6795

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-379 Creation of Temporary File in Directory with Insecure Permissions
  • CWE-668 Exposure of Resource to Wrong Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.