{"id":"CVE-2023-3899","summary":"Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration","details":"A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.","modified":"2026-08-12T03:51:29.737828836Z","published":"2023-08-23T10:49:11.684Z","related":["ALSA-2023:4706","ALSA-2023:4708"],"database_specific":{"cna_assigner":"redhat","cwe_ids":["CWE-285"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3899.json"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJHKSBBZRDFOBNDU35FUKMYQIQYT6UJQ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDIHGNLS3TZVX7X2F735OKI4KXPY4AH6/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:4701"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:4702"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:4703"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:4704"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:4705"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:4706"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:4707"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:4708"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2023-3899"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3899.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3899"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225407"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/candlepin/subscription-manager","events":[{"introduced":"0"},{"fixed":"cf12ae6eb3f7c8c39f3af1ae8162ad3dd5a5fb1f"},{"introduced":"1914f1a226e49a564688086206f441a3c0f445b1"},{"fixed":"7e9412585fea713b39b937bd6c9d485c2534cc31"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.28.39"},{"introduced":"1.29.0"},{"fixed":"1.29.37"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:redhat:subscription-manager:*:*:*:*:*:*:*:*"}}],"versions":["subscription-manager-1.29.36-1","subscription-manager-1.29.35-1","subscription-manager-1.28.36-1","subscription-manager-1.28.38-1","subscription-manager-1.28.37-1","subscription-manager-1.29.34-1","subscription-manager-1.29.33-1","subscription-manager-1.28.35-1","subscription-manager-1.29.32-1","subscription-manager-1.28.34-1","subscription-manager-1.28.33-1","subscription-manager-1.29.31-1","subscription-manager-1.28.32-1","subscription-manager-1.29.30-1","subscription-manager-1.29.29-1","subscription-manager-1.28.31-1","subscription-manager-1.29.28-1","subscription-manager-1.28.30-1","subscription-manager-1.28.29-1","subscription-manager-1.28.28-1","subscription-manager-1.29.26-1","subscription-manager-1.29.25-1","subscription-manager-1.28.27-1","subscription-manager-1.28.26-1","subscription-manager-1.29.24-1","subscription-manager-1.29.23-1","subscription-manager-1.28.25-1","subscription-manager-1.29.20-1","subscription-manager-1.28.24-1","subscription-manager-1.28.23-1","subscription-manager-1.29.21-1","subscription-manager-1.28.22-1","subscription-manager-1.29.19-1","subscription-manager-1.28.21-1","subscription-manager-1.28.19-1","subscription-manager-1.28.20-1","subscription-manager-1.29.18-1","subscription-manager-1.28.18-1","subscription-manager-1.29.17-1","subscription-manager-1.29.16-1","subscription-manager-1.29.15-1","subscription-manager-1.29.14-1","subscription-manager-1.29.13-1","subscription-manager-1.28.17-1","subscription-manager-1.29.12-1","subscription-manager-1.28.16-1","subscription-manager-1.29.11-1","subscription-manager-1.29.10-1","subscription-manager-1.28.15-1","subscription-manager-1.28.13-1","subscription-manager-1.29.9-1","subscription-manager-1.29.8-1","subscription-manager-1.28.12-1","subscription-manager-1.28.11-1","subscription-manager-1.29.7-1","subscription-manager-1.28.10-1","subscription-manager-1.29.6-1","subscription-manager-1.28.9-1","subscription-manager-1.29.5-1","subscription-manager-1.29.4-1","subscription-manager-1.28.8-1","subscription-manager-1.29.3-1","subscription-manager-1.29.2-1","subscription-manager-1.28.7-1","subscription-manager-1.29.1-1","subscription-manager-1.28.6-1","subscription-manager-1.29.0-1","subscription-manager-1.28.5-1","subscription-manager-1.28.4-1","subscription-manager-1.28.3-1","subscription-manager-1.28.2-1","subscription-manager-1.28.1-1","subscription-manager-1.28.0-1","subscription-manager-1.27.5-1","subscription-manager-1.27.4-1","subscription-manager-1.27.3-1","subscription-manager-1.27.2-1","subscription-manager-1.27.1-1","subscription-manager-1.25.11-1","subscription-manager-1.26.4-1","subscription-manager-1.26.3-1","subscription-manager-1.26.2-1","subscription-manager-1.26.1-1","subscription-manager-1.25.10-1","subscription-manager-1.25.9-1","subscription-manager-1.25.8-1","subscription-manager-1.25.7-1","subscription-manager-1.25.6-1","subscription-manager-1.25.3-1","subscription-manager-1.25.5-1","subscription-manager-1.25.4-1","subscription-manager-1.25.1-1","subscription-manager-1.24.2-1","subscription-manager-1.24.1-1","subscription-manager-1.24.0-1","subscription-manager-1.23.4-1","subscription-manager-1.23.3-1","subscription-manager-1.23.2-1","subscription-manager-1.23.1-1","subscription-manager-1.22.1-1","subscription-manager-1.22.0-1","subscription-manager-1.21.5-1","subscription-manager-1.21.4-3","subscription-manager-1.21.4-2","subscription-manager-1.21.4-1","subscription-manager-1.21.3-1","subscription-manager-1.21.2-3","subscription-manager-1.21.2-2","subscription-manager-1.21.2-1","subscription-manager-1.21.1-1","subscription-manager-1.20.8-1","subscription-manager-1.20.7-1","subscription-manager-1.20.6-1","subscription-manager-1.20.5-1","subscription-manager-1.20.4-1","subscription-manager-1.20.3-1","subscription-manager-1.20.2-1","python-rhsm-1.20.2-1","subscription-manager-1.20.1-1","python-rhsm-1.20.1-1","subscription-manager-1.19.12-1","subscription-manager-1.20.0-1","python-rhsm-1.20.0-1","python-rhsm-1.19.6-1","subscription-manager-1.19.11-1","subscription-manager-1.19.10-1","subscription-manager-1.19.9-1","subscription-manager-1.19.8-1","python-rhsm-1.19.5-1","subscription-manager-1.19.7-1","subscription-manager-1.19.6-1","python-rhsm-1.19.4-1","python-rhsm-1.19.3-1","subscription-manager-1.19.5-1","subscription-manager-1.19.4-1","subscription-manager-1.19.3-1","python-rhsm-1.19.2-1","subscription-manager-1.19.2-1","subscription-manager-1.19.1-1","subscription-manager-1.19.0-1","subscription-manager-1.18.6-1","subscription-manager-1.18.4-1","subscription-manager-1.18.5-1","subscription-manager-1.18.3-1","subscription-manager-1.18.2-1","subscription-manager-1.17.9-1","subscription-manager-1.18.1-1","subscription-manager-1.17.8-1","subscription-manager-1.17.7-1","subscription-manager-1.17.6-1","subscription-manager-1.17.5-1","subscription-manager-1.17.4-1","subscription-manager-1.17.3-1","subscription-manager-1.17.2-1","subscription-manager-1.17.1-1","subscription-manager-1.16.8-1","subscription-manager-1.16.7-1","subscription-manager-1.16.6-1","subscription-manager-1.16.5-1","subscription-manager-1.16.4-1","subscription-manager-1.16.3-1","subscription-manager-1.16.2-1","subscription-manager-1.16.1-1","subscription-manager-1.16.0-1","subscription-manager-1.15.7-1","subscription-manager-1.15.6-1","subscription-manager-1.15.5-1","subscription-manager-1.15.4-1","subscription-manager-1.15.3-1","subscription-manager-1.15.2-1","subscription-manager-1.15.1-1","subscription-manager-1.14.9-1","subscription-manager-1.14.8-1","subscription-manager-1.14.7-1","subscription-manager-1.14.6-1","subscription-manager-1.14.5-1","subscription-manager-1.14.4-1","subscription-manager-1.14.3-1","subscription-manager-1.14.2-1","subscription-manager-1.14.1-1","subscription-manager-1.13.13-1","subscription-manager-1.13.12-1","subscription-manager-1.13.11-1","subscription-manager-1.13.10-1","subscription-manager-1.13.9-1","subscription-manager-1.13.8-1","subscription-manager-1.13.7-1","subscription-manager-1.13.6-1","subscription-manager-1.13.5-1","subscription-manager-1.13.4-1","subscription-manager-1.13.3-1","subscription-manager-1.13.2-1","subscription-manager-1.13.1-1","subscription-manager-1.12.13-1","subscription-manager-1.12.14-1","subscription-manager-1.12.11-1","subscription-manager-1.12.12-1","subscription-manager-1.12.10-1","subscription-manager-1.12.9-1","subscription-manager-1.12.8-1","subscription-manager-1.12.7-1","subscription-manager-1.12.6-1","subscription-manager-1.12.5-1","subscription-manager-1.12.4-1","subscription-manager-1.12.3-1","subscription-manager-1.12.2-1","subscription-manager-1.12.1-1","subscription-manager-1.11.7-1","subscription-manager-1.11.6-1","subscription-manager-1.11.5-1","subscription-manager-1.11.4-1","subscription-manager-1.11.3-1","subscription-manager-1.11.2-1","subscription-manager-1.11.1-1","subscription-manager-1.10.14-1","subscription-manager-1.10.13-1","subscription-manager-1.10.11-1","subscription-manager-1.10.10-1","subscription-manager-1.10.9-1","subscription-manager-1.10.8-1","subscription-manager-1.10.7-1","subscription-manager-1.10.6-1","subscription-manager-1.10.5-1","subscription-manager-1.10.4-1","subscription-manager-1.10.3-1","subscription-manager-1.10.2-1","subscription-manager-1.10.1-1","subscription-manager-1.9.2-1","subscription-manager-1.9.1-1","subscription-manager-1.8.13-1","subscription-manager-1.8.12-1","subscription-manager-1.8.11-1","subscription-manager-1.8.10-1","subscription-manager-1.8.9-1","subscription-manager-1.8.8-1","subscription-manager-1.8.6-1","subscription-manager-1.8.5-1","subscription-manager-1.8.3-1","subscription-manager-1.8.2-1","subscription-manager-1.8.1-1","subscription-manager-1.1.10-1","subscription-manager-1.8.0-1","subscription-manager-1.1.9-1","subscription-manager-1.1.8-1","subscription-manager-1.1.6-1","subscription-manager-1.1.5-1","subscription-manager-1.1.4-1","subscription-manager-1.1.3-1","subscription-manager-1.1.2-1","subscription-manager-1.1.1-1","subscription-manager-1.0.17-1","subscription-manager-1.0.16-1","subscription-manager-1.0.15-1","subscription-manager-1.0.14-1","subscription-manager-1.0.13-1","subscription-manager-1.0.12-1","subscription-manager-1.0.11-1","subscription-manager-1.0.10-1","subscription-manager-1.0.9-1","subscription-manager-1.0.8-1","subscription-manager-1.0.7-1","subscription-manager-1.0.6-1","subscription-manager-1.0.5-1","subscription-manager-1.0.4-1","subscription-manager-1.0.2-1","subscription-manager-0.99.13-1","subscription-manager-0.99.12-1","subscription-manager-0.99.11-1","subscription-manager-0.99.10-1","subscription-manager-0.99.9-1","subscription-manager-0.99.8-1","subscription-manager-0.99.7-1","subscription-manager-0.99.6-1","subscription-manager-0.99.5-1","subscription-manager-0.99.4-1","subscription-manager-0.99.3-1","subscription-manager-0.99.2-1","subscription-manager-0.98.8-1","subscription-manager-0.98.7-1","subscription-manager-0.98.6-1","subscription-manager-0.98.2-1","subscription-manager-0.97.2-1","subscription-manager-0.97.1-1","subscription-manager-0.96.9-1","subscription-manager-0.96.7-1","subscription-manager-0.96.6-1","subscription-manager-0.96.4-1","subscription-manager-0.96.2-1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3899.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}