Bug 13945

Please patch CVEs for package subscription-manager version 1.9.6
  
INFO (CVEs are): subscription-manager 1.9.6
 cves found
CVE-2017-2663
Desc: It was found that subscription-manager's DBus interface before 1.19.4 let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and com.redhat.RHSM1.Config.Set methods. An unprivileged local attacker could use these methods to gain access to private information, or launch a privilege escalation attack.
Link: https://nvd.nist.gov/vuln/detail/CVE-2017-2663
Severity: HIGH
CVE-2023-3899
Desc: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-3899
Severity: HIGH