CVE-2019-13313
Fixed in a distro release EPSS <1%
libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line.
Products: libosinfo, fedoraproject fedora, redhat enterprise_linux, redhat enterprise_linux_eus, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_tus
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | libosinfo | 1.1.0-5.amzn2 |
| Amazon Linux 2 | libosinfo-devel | 1.1.0-5.amzn2 |
| Amazon Linux 2 | libosinfo-vala | 1.1.0-5.amzn2 |
| Debian 12 | libosinfo | 1.6.0-1 |
| Debian 13 | libosinfo | 1.6.0-1 |
| Debian 14 | libosinfo | 1.6.0-1 |
| Red Hat Enterprise Linux 7 | libosinfo | 0:1.1.0-5.el7 |
| Red Hat Enterprise Linux 7 | libosinfo-debuginfo | 0:1.1.0-5.el7 |
| Red Hat Enterprise Linux 7 | libosinfo-devel | 0:1.1.0-5.el7 |
| Red Hat Enterprise Linux 7 | libosinfo-vala | 0:1.1.0-5.el7 |
| Red Hat Enterprise Linux 8 | gnome-boxes | 0:3.28.5-7.el8 |
| Red Hat Enterprise Linux 8 | gnome-boxes-debuginfo | 0:3.28.5-7.el8 |
| Red Hat Enterprise Linux 8 | gnome-boxes-debugsource | 0:3.28.5-7.el8 |
| Red Hat Enterprise Linux 8 | libosinfo | 0:1.5.0-3.el8 |
| Red Hat Enterprise Linux 8 | libosinfo-debuginfo | 0:1.5.0-3.el8 |
| Red Hat Enterprise Linux 8 | libosinfo-debugsource | 0:1.5.0-3.el8 |
| Red Hat Enterprise Linux 8 | osinfo-db | 0:20190611-1.el8 |
| Red Hat Enterprise Linux 8 | osinfo-db-tools | 0:1.5.0-4.el8 |
| Red Hat Enterprise Linux 8 | osinfo-db-tools-debuginfo | 0:1.5.0-4.el8 |
| Red Hat Enterprise Linux 8 | osinfo-db-tools-debugsource | 0:1.5.0-4.el8 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | libosinfo | 0.2.12-13.3.1 |
| SUSE Linux Enterprise Server 12 SP5 | libosinfo | 1.2.0-3.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | libosinfo | 0.2.12-13.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | libosinfo | 1.2.0-3.3.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | libosinfo | 1.2.0-3.3.2 |
| Ubuntu 16.04 LTS | libosinfo | no fix |
| Ubuntu 18.04 LTS | libosinfo | no fix |