Red Hat Security AdvisoryRHSA-2019:0420
polkit security update
Released 2019-02-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) polkit-0.96-11.el6_10.1, polkit-desktop-policy-0.96-11.el6_10.1
- Red Hat Enterprise Linux Desktop Optional (v. 6) polkit-devel-0.96-11.el6_10.1, polkit-docs-0.96-11.el6_10.1
- Red Hat Enterprise Linux HPC Node (v. 6) polkit-0.96-11.el6_10.1
- Red Hat Enterprise Linux HPC Node Optional (v. 6) polkit-desktop-policy-0.96-11.el6_10.1, polkit-devel-0.96-11.el6_10.1, polkit-docs-0.96-11.el6_10.1
- Red Hat Enterprise Linux Server (v. 6) polkit-0.96-11.el6_10.1, polkit-0.96-11.el6_10.1.ppc, polkit-desktop-policy-0.96-11.el6_10.1 +3
- Red Hat Enterprise Linux Workstation (v. 6) polkit-0.96-11.el6_10.1, polkit-desktop-policy-0.96-11.el6_10.1, polkit-devel-0.96-11.el6_10.1 +1
Fixes 1 record
Priority LOW 30
In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached.
CVSS 3.0MEDIUM 6.7· Local · Low privileges · User interaction · EPSS 0.00446 · Published 2019-01-11 · Partial fix CWE-362
