Red Hat Security AdvisoryRHSA-2019:0230
polkit security update
Released 2019-01-31 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) polkit-0.112-18.el7_6.1
- Red Hat Enterprise Linux Client Optional (v. 7) polkit-devel-0.112-18.el7_6.1, polkit-docs-0.112-18.el7_6.1
- Red Hat Enterprise Linux ComputeNode (v. 7) polkit-0.112-18.el7_6.1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) polkit-devel-0.112-18.el7_6.1, polkit-docs-0.112-18.el7_6.1
- Red Hat Enterprise Linux Server (v. 7) polkit-0.112-18.el7_6.1, polkit-0.112-18.el7_6.1.ppc, polkit-devel-0.112-18.el7_6.1 +2
- Red Hat Enterprise Linux Workstation (v. 7) polkit-0.112-18.el7_6.1, polkit-devel-0.112-18.el7_6.1, polkit-docs-0.112-18.el7_6.1
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) polkit-0.112-18.el7_6.1, polkit-devel-0.112-18.el7_6.1, polkit-docs-0.112-18.el7_6.1
Fixes 1 record
Priority LOW 30
In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached.
CVSS 3.0MEDIUM 6.7· Local · Low privileges · User interaction · EPSS 0.00446 · Published 2019-01-11 · Partial fix CWE-362
