Skip to content
Heist/ feed
Back to feed
High

Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

Type: advisorySources: OSV

A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2023-3899
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 18:47 UTC · Revision 1

Source evidence

Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

core-osv · Original source

Published 23 Aug 2023, 10:49 UTC

A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.

osv:CVE-2023-3899
Complete source record
{
  "id": "8da3f3c75c219033b2cc535017a9b048d90e3eed92bed55bcbd8ee67ff21e145",
  "url": "https://osv.dev/vulnerability/CVE-2023-3899",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration",
    "summary": "A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.",
    "evidence": "osv:CVE-2023-3899",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2023-3899",
      "aliases": [
        "CVE-2023-3899"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/candlepin/subscription-manager",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "cf12ae6eb3f7c8c39f3af1ae8162ad3dd5a5fb1f"
                },
                {
                  "introduced": "1914f1a226e49a564688086206f441a3c0f445b1"
                },
                {
                  "fixed": "7e9412585fea713b39b937bd6c9d485c2534cc31"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:redhat:subscription-manager:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.28.39"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:redhat:subscription-manager:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "1.29.0"
                      },
                      {
                        "fixed": "1.29.37"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "subscription-manager-1.29.36-1",
            "subscription-manager-1.29.35-1",
            "subscription-manager-1.28.36-1",
            "subscription-manager-1.28.38-1",
            "subscription-manager-1.28.37-1",
            "subscription-manager-1.29.34-1",
            "subscription-manager-1.29.33-1",
            "subscription-manager-1.28.35-1",
            "subscription-manager-1.29.32-1",
            "subscription-manager-1.28.34-1",
            "subscription-manager-1.28.33-1",
            "subscription-manager-1.29.31-1",
            "subscription-manager-1.28.32-1",
            "subscription-manager-1.29.30-1",
            "subscription-manager-1.29.29-1",
            "subscription-manager-1.28.31-1",
            "subscription-manager-1.29.28-1",
            "subscription-manager-1.28.30-1",
            "subscription-manager-1.28.29-1",
            "subscription-manager-1.28.28-1",
            "subscription-manager-1.29.26-1",
            "subscription-manager-1.29.25-1",
            "subscription-manager-1.28.27-1",
            "subscription-manager-1.28.26-1",
            "subscription-manager-1.29.24-1",
            "subscription-manager-1.29.23-1",
            "subscription-manager-1.28.25-1",
            "subscription-manager-1.29.20-1",
            "subscription-manager-1.28.24-1",
            "subscription-manager-1.28.23-1",
            "subscription-manager-1.29.21-1",
            "subscription-manager-1.28.22-1",
            "subscription-manager-1.29.19-1",
            "subscription-manager-1.28.21-1",
            "subscription-manager-1.28.19-1",
            "subscription-manager-1.28.20-1",
            "subscription-manager-1.29.18-1",
            "subscription-manager-1.28.18-1",
            "subscription-manager-1.29.17-1",
            "subscription-manager-1.29.16-1",
            "subscription-manager-1.29.15-1",
            "subscription-manager-1.29.14-1",
            "subscription-manager-1.29.13-1",
            "subscription-manager-1.28.17-1",
            "subscription-manager-1.29.12-1",
            "subscription-manager-1.28.16-1",
            "subscription-manager-1.29.11-1",
            "subscription-manager-1.29.10-1",
            "subscription-manager-1.28.15-1",
            "subscription-manager-1.28.13-1",
            "subscription-manager-1.29.9-1",
            "subscription-manager-1.29.8-1",
            "subscription-manager-1.28.12-1",
            "subscription-manager-1.28.11-1",
            "subscription-manager-1.29.7-1",
            "subscription-manager-1.28.10-1",
            "subscription-manager-1.29.6-1",
            "subscription-manager-1.28.9-1",
            "subscription-manager-1.29.5-1",
            "subscription-manager-1.29.4-1",
            "subscription-manager-1.28.8-1",
            "subscription-manager-1.29.3-1",
            "subscription-manager-1.29.2-1",
            "subscription-manager-1.28.7-1",
            "subscription-manager-1.29.1-1",
            "subscription-manager-1.28.6-1",
            "subscription-manager-1.29.0-1",
            "subscription-manager-1.28.5-1",
            "subscription-manager-1.28.4-1",
            "subscription-manager-1.28.3-1",
            "subscription-manager-1.28.2-1",
            "subscription-manager-1.28.1-1",
            "subscription-manager-1.28.0-1",
            "subscription-manager-1.27.5-1",
            "subscription-manager-1.27.4-1",
            "subscription-manager-1.27.3-1",
            "subscription-manager-1.27.2-1",
            "subscription-manager-1.27.1-1",
            "subscription-manager-1.25.11-1",
            "subscription-manager-1.26.4-1",
            "subscription-manager-1.26.3-1",
            "subscription-manager-1.26.2-1",
            "subscription-manager-1.26.1-1",
            "subscription-manager-1.25.10-1",
            "subscription-manager-1.25.9-1",
            "subscription-manager-1.25.8-1",
            "subscription-manager-1.25.7-1",
            "subscription-manager-1.25.6-1",
            "subscription-manager-1.25.3-1",
            "subscription-manager-1.25.5-1",
            "subscription-manager-1.25.4-1",
            "subscription-manager-1.25.1-1",
            "subscription-manager-1.24.2-1",
            "subscription-manager-1.24.1-1",
            "subscription-manager-1.24.0-1",
            "subscription-manager-1.23.4-1",
            "subscription-manager-1.23.3-1",
            "subscription-manager-1.23.2-1",
            "subscription-manager-1.23.1-1",
            "subscription-manager-1.22.1-1",
            "subscription-manager-1.22.0-1",
            "subscription-manager-1.21.5-1",
            "subscription-manager-1.21.4-3",
            "subscription-manager-1.21.4-2",
            "subscription-manager-1.21.4-1",
            "subscription-manager-1.21.3-1",
            "subscription-manager-1.21.2-3",
            "subscription-manager-1.21.2-2",
            "subscription-manager-1.21.2-1",
            "subscription-manager-1.21.1-1",
            "subscription-manager-1.20.8-1",
            "subscription-manager-1.20.7-1",
            "subscription-manager-1.20.6-1",
            "subscription-manager-1.20.5-1",
            "subscription-manager-1.20.4-1",
            "subscription-manager-1.20.3-1",
            "subscription-manager-1.20.2-1",
            "python-rhsm-1.20.2-1",
            "subscription-manager-1.20.1-1",
            "python-rhsm-1.20.1-1",
            "subscription-manager-1.19.12-1",
            "subscription-manager-1.20.0-1",
            "python-rhsm-1.20.0-1",
            "python-rhsm-1.19.6-1",
            "subscription-manager-1.19.11-1",
            "subscription-manager-1.19.10-1",
            "subscription-manager-1.19.9-1",
            "subscription-manager-1.19.8-1",
            "python-rhsm-1.19.5-1",
            "subscription-manager-1.19.7-1",
            "subscription-manager-1.19.6-1",
            "python-rhsm-1.19.4-1",
            "python-rhsm-1.19.3-1",
            "subscription-manager-1.19.5-1",
            "subscription-manager-1.19.4-1",
            "subscription-manager-1.19.3-1",
            "python-rhsm-1.19.2-1",
            "subscription-manager-1.19.2-1",
            "subscription-manager-1.19.1-1",
            "subscription-manager-1.19.0-1",
            "subscription-manager-1.18.6-1",
            "subscription-manager-1.18.4-1",
            "subscription-manager-1.18.5-1",
            "subscription-manager-1.18.3-1",
            "subscription-manager-1.18.2-1",
            "subscription-manager-1.17.9-1",
            "subscription-manager-1.18.1-1",
            "subscription-manager-1.17.8-1",
            "subscription-manager-1.17.7-1",
            "subscription-manager-1.17.6-1",
            "subscription-manager-1.17.5-1",
            "subscription-manager-1.17.4-1",
            "subscription-manager-1.17.3-1",
            "subscription-manager-1.17.2-1",
            "subscription-manager-1.17.1-1",
            "subscription-manager-1.16.8-1",
            "subscription-manager-1.16.7-1",
            "subscription-manager-1.16.6-1",
            "subscription-manager-1.16.5-1",
            "subscription-manager-1.16.4-1",
            "subscription-manager-1.16.3-1",
            "subscription-manager-1.16.2-1",
            "subscription-manager-1.16.1-1",
            "subscription-manager-1.16.0-1",
            "subscription-manager-1.15.7-1",
            "subscription-manager-1.15.6-1",
            "subscription-manager-1.15.5-1",
            "subscription-manager-1.15.4-1",
            "subscription-manager-1.15.3-1",
            "subscription-manager-1.15.2-1",
            "subscription-manager-1.15.1-1",
            "subscription-manager-1.14.9-1",
            "subscription-manager-1.14.8-1",
            "subscription-manager-1.14.7-1",
            "subscription-manager-1.14.6-1",
            "subscription-manager-1.14.5-1",
            "subscription-manager-1.14.4-1",
            "subscription-manager-1.14.3-1",
            "subscription-manager-1.14.2-1",
            "subscription-manager-1.14.1-1",
            "subscription-manager-1.13.13-1",
            "subscription-manager-1.13.12-1",
            "subscription-manager-1.13.11-1",
            "subscription-manager-1.13.10-1",
            "subscription-manager-1.13.9-1",
            "subscription-manager-1.13.8-1",
            "subscription-manager-1.13.7-1",
            "subscription-manager-1.13.6-1",
            "subscription-manager-1.13.5-1",
            "subscription-manager-1.13.4-1",
            "subscription-manager-1.13.3-1",
            "subscription-manager-1.13.2-1",
            "subscription-manager-1.13.1-1",
            "subscription-manager-1.12.13-1",
            "subscription-manager-1.12.14-1",
            "subscription-manager-1.12.11-1",
            "subscription-manager-1.12.12-1",
            "subscription-manager-1.12.10-1",
            "subscription-manager-1.12.9-1",
            "subscription-manager-1.12.8-1",
            "subscription-manager-1.12.7-1",
            "subscription-manager-1.12.6-1",
            "subscription-manager-1.12.5-1",
            "subscription-manager-1.12.4-1",
            "subscription-manager-1.12.3-1",
            "subscription-manager-1.12.2-1",
            "subscription-manager-1.12.1-1",
            "subscription-manager-1.11.7-1",
            "subscription-manager-1.11.6-1",
            "subscription-manager-1.11.5-1",
            "subscription-manager-1.11.4-1",
            "subscription-manager-1.11.3-1",
            "subscription-manager-1.11.2-1",
            "subscription-manager-1.11.1-1",
            "subscription-manager-1.10.14-1",
            "subscription-manager-1.10.13-1",
            "subscription-manager-1.10.11-1",
            "subscription-manager-1.10.10-1",
            "subscription-manager-1.10.9-1",
            "subscription-manager-1.10.8-1",
            "subscription-manager-1.10.7-1",
            "subscription-manager-1.10.6-1",
            "subscription-manager-1.10.5-1",
            "subscription-manager-1.10.4-1",
            "subscription-manager-1.10.3-1",
            "subscription-manager-1.10.2-1",
            "subscription-manager-1.10.1-1",
            "subscription-manager-1.9.2-1",
            "subscription-manager-1.9.1-1",
            "subscription-manager-1.8.13-1",
            "subscription-manager-1.8.12-1",
            "subscription-manager-1.8.11-1",
            "subscription-manager-1.8.10-1",
            "subscription-manager-1.8.9-1",
            "subscription-manager-1.8.8-1",
            "subscription-manager-1.8.6-1",
            "subscription-manager-1.8.5-1",
            "subscription-manager-1.8.3-1",
            "subscription-manager-1.8.2-1",
            "subscription-manager-1.8.1-1",
            "subscription-manager-1.1.10-1",
            "subscription-manager-1.8.0-1",
            "subscription-manager-1.1.9-1",
            "subscription-manager-1.1.8-1",
            "subscription-manager-1.1.6-1",
            "subscription-manager-1.1.5-1",
            "subscription-manager-1.1.4-1",
            "subscription-manager-1.1.3-1",
            "subscription-manager-1.1.2-1",
            "subscription-manager-1.1.1-1",
            "subscription-manager-1.0.17-1",
            "subscription-manager-1.0.16-1",
            "subscription-manager-1.0.15-1",
            "subscription-manager-1.0.14-1",
            "subscription-manager-1.0.13-1",
            "subscription-manager-1.0.12-1",
            "subscription-manager-1.0.11-1",
            "subscription-manager-1.0.10-1",
            "subscription-manager-1.0.9-1",
            "subscription-manager-1.0.8-1",
            "subscription-manager-1.0.7-1",
            "subscription-manager-1.0.6-1",
            "subscription-manager-1.0.5-1",
            "subscription-manager-1.0.4-1",
            "subscription-manager-1.0.2-1",
            "subscription-manager-0.99.13-1",
            "subscription-manager-0.99.12-1",
            "subscription-manager-0.99.11-1",
            "subscription-manager-0.99.10-1",
            "subscription-manager-0.99.9-1",
            "subscription-manager-0.99.8-1",
            "subscription-manager-0.99.7-1",
            "subscription-manager-0.99.6-1",
            "subscription-manager-0.99.5-1",
            "subscription-manager-0.99.4-1",
            "subscription-manager-0.99.3-1",
            "subscription-manager-0.99.2-1",
            "subscription-manager-0.98.8-1",
            "subscription-manager-0.98.7-1",
            "subscription-manager-0.98.6-1",
            "subscription-manager-0.98.2-1",
            "subscription-manager-0.97.2-1",
            "subscription-manager-0.97.1-1",
            "subscription-manager-0.96.9-1",
            "subscription-manager-0.96.7-1",
            "subscription-manager-0.96.6-1",
            "subscription-manager-0.96.4-1",
            "subscription-manager-0.96.2-1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3899.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:22.310549257Z",
      "provider": "osv",
      "references": [
        "https://access.redhat.com/downloads/content/package-browser/",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJHKSBBZRDFOBNDU35FUKMYQIQYT6UJQ/",
        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDIHGNLS3TZVX7X2F735OKI4KXPY4AH6/",
        "https://access.redhat.com/errata/RHSA-2023:4701",
        "https://access.redhat.com/errata/RHSA-2023:4702",
        "https://access.redhat.com/errata/RHSA-2023:4703",
        "https://access.redhat.com/errata/RHSA-2023:4704",
        "https://access.redhat.com/errata/RHSA-2023:4705",
        "https://access.redhat.com/errata/RHSA-2023:4706",
        "https://access.redhat.com/errata/RHSA-2023:4707",
        "https://access.redhat.com/errata/RHSA-2023:4708",
        "https://access.redhat.com/security/cve/CVE-2023-3899",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3899.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-3899",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2225407"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-285"
        ],
        "cna_assigner": "redhat",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "fixed": "0:1.24.52-2.el7_9"
                  },
                  {
                    "fixed": "0:1.28.36-3.el8_8"
                  },
                  {
                    "fixed": "0:1.28.36-3.el8_8"
                  },
                  {
                    "fixed": "0:1.25.17.1-2.el8_1"
                  },
                  {
                    "fixed": "0:1.26.22-2.el8_2"
                  },
                  {
                    "fixed": "0:1.26.22-2.el8_2"
                  },
                  {
                    "fixed": "0:1.26.22-2.el8_2"
                  },
                  {
                    "fixed": "0:1.28.13-7.el8_4"
                  },
                  {
                    "fixed": "0:1.28.13-7.el8_4"
                  },
                  {
                    "fixed": "0:1.28.13-7.el8_4"
                  },
                  {
                    "fixed": "0:1.28.29.1-2.el8_6"
                  },
                  {
                    "fixed": "0:1.29.33.1-2.el9_2"
                  },
                  {
                    "fixed": "0:1.29.26.2-2.el9_0"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "InverseAffectedRanges"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3899.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-3899",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 488760,
  "published_at": "2023-08-23T10:49:11.684+00:00"
}