dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in…
Priority LOW 34CWE-59Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 23 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0055 46th percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 23 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:freedesktop:dbus:*:*:*:*:*:*:*:* | before 1.10.28; 1.12.0 to before 1.12.16; 1.13.0 to before 1.13.12 | Vulnerable | Freedesktop |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* | 18.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* | 19.04 | Vulnerable | Canonical |
- cpe:2.3:a:freedesktop:dbus:*:*:*:*:*:*:*:* Versions before 1.10.28; 1.12.0 to before 1.12.16; 1.13.0 to before 1.13.12 Vulnerable ·Freedesktop
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
Remediation
Red Hat 6 advisories
- RHSA-2021:0949 Released 2021-03-22 · Red Hat rating LowRed Hat OpenShift Do openshift/odo-init-image 1.1.3 security update
- OpenShift Do 1 openshiftdo/odo-init-image-rhel7
- RHSA-2020:4032 Released 2020-09-29 · Red Hat rating Moderatedbus security update
- Red Hat Enterprise Linux Client (v. 7) dbus-1:1.10.24-15.el7, dbus-libs-1:1.10.24-15.el7, dbus-x11-1:1.10.24-15.el7
- Red Hat Enterprise Linux Client Optional (v. 7) dbus-devel-1:1.10.24-15.el7, dbus-doc-1:1.10.24-15.el7, dbus-tests-1:1.10.24-15.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) dbus-1:1.10.24-15.el7, dbus-libs-1:1.10.24-15.el7, dbus-x11-1:1.10.24-15.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) dbus-devel-1:1.10.24-15.el7, dbus-doc-1:1.10.24-15.el7, dbus-tests-1:1.10.24-15.el7
- Red Hat Enterprise Linux Server (v. 7) dbus-1:1.10.24-15.el7, dbus-devel-1:1.10.24-15.el7, dbus-devel-1:1.10.24-15.el7.ppc +3
- Red Hat Enterprise Linux Server Optional (v. 7) dbus-doc-1:1.10.24-15.el7, dbus-tests-1:1.10.24-15.el7
- Red Hat Enterprise Linux Workstation (v. 7) dbus-1:1.10.24-15.el7, dbus-devel-1:1.10.24-15.el7, dbus-libs-1:1.10.24-15.el7 +1
- Red Hat Enterprise Linux Workstation Optional (v. 7) dbus-doc-1:1.10.24-15.el7, dbus-tests-1:1.10.24-15.el7
- RHSA-2019:3707 Released 2019-11-05 · Red Hat rating Moderatedbus security update
- Red Hat Enterprise Linux AppStream (v. 8) dbus-devel-1:1.12.8-9.el8, dbus-x11-1:1.12.8-9.el8
- Red Hat Enterprise Linux BaseOS (v. 8) dbus-1:1.12.8-9.el8, dbus-common-1:1.12.8-9.el8, dbus-daemon-1:1.12.8-9.el8 +2
Show 3 more Red Hat advisories
- RHSA-2019:2868 Released 2019-09-23 · Red Hat rating Importantdbus security update
- Red Hat Enterprise Linux Server AUS (v. 6.6) dbus-1:1.2.24-9.el6_6, dbus-devel-1:1.2.24-9.el6_6, dbus-libs-1:1.2.24-9.el6_6 +1
- Red Hat Enterprise Linux Server Optional AUS (v. 6.6) dbus-doc-1:1.2.24-9.el6_6
- RHSA-2019:2870 Released 2019-09-23 · Red Hat rating Importantdbus security update
- Red Hat Enterprise Linux Server AUS (v. 6.5) dbus-1:1.2.24-9.el6_5, dbus-devel-1:1.2.24-9.el6_5, dbus-libs-1:1.2.24-9.el6_5 +1
- Red Hat Enterprise Linux Server Optional AUS (v. 6.5) dbus-1:1.2.24-9.el6_5, dbus-doc-1:1.2.24-9.el6_5
- RHSA-2019:1726 Released 2019-07-10 · Red Hat rating Importantdbus security update
- Red Hat Enterprise Linux Desktop (v. 6) dbus-1:1.2.24-11.el6_10, dbus-libs-1:1.2.24-11.el6_10, dbus-x11-1:1.2.24-11.el6_10
- Red Hat Enterprise Linux Desktop Optional (v. 6) dbus-devel-1:1.2.24-11.el6_10, dbus-doc-1:1.2.24-11.el6_10
- Red Hat Enterprise Linux HPC Node (v. 6) dbus-1:1.2.24-11.el6_10, dbus-libs-1:1.2.24-11.el6_10, dbus-x11-1:1.2.24-11.el6_10
- Red Hat Enterprise Linux HPC Node Optional (v. 6) dbus-devel-1:1.2.24-11.el6_10, dbus-doc-1:1.2.24-11.el6_10
- Red Hat Enterprise Linux Server (v. 6) dbus-1:1.2.24-11.el6_10, dbus-devel-1:1.2.24-11.el6_10, dbus-devel-1:1.2.24-11.el6_10.ppc +3
- Red Hat Enterprise Linux Server Optional (v. 6) dbus-doc-1:1.2.24-11.el6_10
- Red Hat Enterprise Linux Workstation (v. 6) dbus-1:1.2.24-11.el6_10, dbus-devel-1:1.2.24-11.el6_10, dbus-libs-1:1.2.24-11.el6_10 +1
- Red Hat Enterprise Linux Workstation Optional (v. 6) dbus-doc-1:1.2.24-11.el6_10
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| OpenShift Do 1 | Fixed | RHSA-2021:0949 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2019:3707 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2019:3707 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2020:4032 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2020:4032 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2020:4032 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2020:4032 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2019:1726 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2019:1726 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2019:1726 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2019:1726 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2019:1726 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:4032 |
| Red Hat Enterprise Linux Server AUS (v. 6.5) | Fixed | RHSA-2019:2870 |
| Red Hat Enterprise Linux Server AUS (v. 6.6) | Fixed | RHSA-2019:2868 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2019:1726 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2020:4032 |
| Red Hat Enterprise Linux Server Optional AUS (v. 6.5) | Fixed | RHSA-2019:2870 |
| Red Hat Enterprise Linux Server Optional AUS (v. 6.6) | Fixed | RHSA-2019:2868 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2019:1726 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:4032 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2019:1726 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2020:4032 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12749
- 2026-10-03 Alias added: GHSA-2hpj-v4f4-7g4j
References
Advisory 14
- https://www.openwall.com/lists/oss-security/2019/06/11/2
- [oss-security] 20190611 CVE-2019-12749: DBusServer DBUS_COOKIE_SHA1 authentication bypass
- USN-4015-1
- USN-4015-2
- DSA-4462
- FEDORA-2019-d5ded5326b
- openSUSE-SU-2019:1604
- openSUSE-SU-2019:1671
- RHSA-2019:1726
- openSUSE-SU-2019:1750
- GLSA-201909-08
- RHSA-2019:2868
- RHSA-2019:2870
- RHSA-2019:3707
Sources
- CVE-2019-12749 · CVE Program
- CVE-2019-12749 · NVD
- FIRST EPSS
- GHSA-2hpj-v4f4-7g4j · GitHub Advisory Database · CC BY 4.0
- CVE-2019-12749 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences