CVE-2019-13313

libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line.

CVSS v3 7.8 HIGH
CVSS v2.0 2.1 LOW

7.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.openwall.com/lists/oss-security/2019/07/08/3	Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3387	Third Party Advisory
https://gitlab.com/libosinfo/libosinfo/-/tags	Release Notes Third Party Advisory
https://gitlab.com/libosinfo/libosinfo/blob/master/NEWS	Release Notes Third Party Advisory
https://libosinfo.org/download/	Release Notes Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AZU4IPPIR73NYC6E733QR26O5ZI6MMKJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEZUZKC6YK4E3NXM7XKZOXY5X5PJSPIR/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4AD73NGYBV7GYT4LFC3TC7AYBWOJTG4/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT44EYZZQFTK7XM6GKCYC4WUE7HYZVXM/
https://www.redhat.com/archives/libosinfo/2019-July/msg00026.html	Mailing List Patch Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/07/08/3	Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3387	Third Party Advisory
https://gitlab.com/libosinfo/libosinfo/-/tags	Release Notes Third Party Advisory
https://gitlab.com/libosinfo/libosinfo/blob/master/NEWS	Release Notes Third Party Advisory
https://libosinfo.org/download/	Release Notes Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AZU4IPPIR73NYC6E733QR26O5ZI6MMKJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEZUZKC6YK4E3NXM7XKZOXY5X5PJSPIR/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4AD73NGYBV7GYT4LFC3TC7AYBWOJTG4/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT44EYZZQFTK7XM6GKCYC4WUE7HYZVXM/
https://www.redhat.com/archives/libosinfo/2019-July/msg00026.html	Mailing List Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:libosinfo:libosinfo:1.5.0:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:29:::::::*
	cpe:2.3:o:fedoraproject:fedora:30:::::::*

Configuration 3 (hide)

OR	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_eus:8.1:::::::*
	cpe:2.3:o:redhat:enterprise_linux_eus:8.2:::::::*
	cpe:2.3:o:redhat:enterprise_linux_eus:8.4:::::::*
	cpe:2.3:o:redhat:enterprise_linux_eus:8.6:::::::*
	cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:::::::*
	cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:::::::*
	cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:::::::*
	cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:::::::*
	cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:::::::*
	cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:::::::*

History

21 Nov 2024, 04:24

Type	Values Removed	Values Added
References	~~() http://www.openwall.com/lists/oss-security/2019/07/08/3 - Mailing List, Third Party Advisory~~	() http://www.openwall.com/lists/oss-security/2019/07/08/3 - Mailing List, Third Party Advisory
References	~~() https://access.redhat.com/errata/RHSA-2019:3387 - Third Party Advisory~~	() https://access.redhat.com/errata/RHSA-2019:3387 - Third Party Advisory
References	~~() https://gitlab.com/libosinfo/libosinfo/-/tags - Release Notes, Third Party Advisory~~	() https://gitlab.com/libosinfo/libosinfo/-/tags - Release Notes, Third Party Advisory
References	~~() https://gitlab.com/libosinfo/libosinfo/blob/master/NEWS - Release Notes, Third Party Advisory~~	() https://gitlab.com/libosinfo/libosinfo/blob/master/NEWS - Release Notes, Third Party Advisory
References	~~() https://libosinfo.org/download/ - Release Notes, Vendor Advisory~~	() https://libosinfo.org/download/ - Release Notes, Vendor Advisory
References	~~() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AZU4IPPIR73NYC6E733QR26O5ZI6MMKJ/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AZU4IPPIR73NYC6E733QR26O5ZI6MMKJ/ -
References	~~() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEZUZKC6YK4E3NXM7XKZOXY5X5PJSPIR/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEZUZKC6YK4E3NXM7XKZOXY5X5PJSPIR/ -
References	~~() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4AD73NGYBV7GYT4LFC3TC7AYBWOJTG4/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4AD73NGYBV7GYT4LFC3TC7AYBWOJTG4/ -
References	~~() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT44EYZZQFTK7XM6GKCYC4WUE7HYZVXM/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT44EYZZQFTK7XM6GKCYC4WUE7HYZVXM/ -
References	~~() https://www.redhat.com/archives/libosinfo/2019-July/msg00026.html - Mailing List, Patch, Third Party Advisory~~	() https://www.redhat.com/archives/libosinfo/2019-July/msg00026.html - Mailing List, Patch, Third Party Advisory

07 Nov 2023, 03:03

Type	Values Removed	Values Added
References	{'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AZU4IPPIR73NYC6E733QR26O5ZI6MMKJ/', 'name': 'FEDORA-2019-4b8990e4d6', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'} {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4AD73NGYBV7GYT4LFC3TC7AYBWOJTG4/', 'name': 'FEDORA-2019-e23aeac13e', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'} {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EEZUZKC6YK4E3NXM7XKZOXY5X5PJSPIR/', 'name': 'FEDORA-2019-c9fbe3db9c', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'} {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT44EYZZQFTK7XM6GKCYC4WUE7HYZVXM/', 'name': 'FEDORA-2019-d2cde4761e', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4AD73NGYBV7GYT4LFC3TC7AYBWOJTG4/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT44EYZZQFTK7XM6GKCYC4WUE7HYZVXM/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEZUZKC6YK4E3NXM7XKZOXY5X5PJSPIR/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AZU4IPPIR73NYC6E733QR26O5ZI6MMKJ/ -

Information

Published : 2019-07-05 14:15

Updated : 2024-11-21 04:24

NVD link : CVE-2019-13313

Mitre link : CVE-2019-13313

CVE.ORG link : CVE-2019-13313

JSON object : View

Products Affected

redhat

enterprise_linux_eus
enterprise_linux_server_tus
enterprise_linux
enterprise_linux_server_aus

fedoraproject

fedora

libosinfo

libosinfo

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

7.8 /10