Red Hat Subscription-Manager vulnerabilities

3 CVEs affecting Red Hat Subscription-Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-3899, published 2023-08-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-4455, published 2017-04-14. Low severity, CVSS 3.3. EPSS: 0.4% chance of exploitation in the next 30 days. The Subscription Manager package (aka subscription-manager) before 1.17.7-1 for Candlepin uses weak permissions (755) for subscription-manager cache directories, which allows local users to obtain…
CVE-2017-2663, published 2018-07-27. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. It was found that subscription-manager's DBus interface before 1.19.4 let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and com.redhat.RHSM1.Config.Set methods. An unprivileged local…
CVE-2023-3899, published 2023-08-23. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods…