All errata/sisyphus/ALT-PU-2019-1771-2
ALT-PU-2019-1771-2

Package update polkit in branch sisyphus

Version0.116-alt1
Task#228976
Published2026-03-07
Max severityMEDIUM
Severity:

Closed issues (2)

BDU:2019-01338
MEDIUM6.7

Уязвимость библиотеки Polkit операционных систем Linux, позволяющая нарушителю выполнить произвольные команды

Published: 2019-04-12Modified: 2024-06-18
CVSS 3.xMEDIUM 6.7
CVSS:3.x/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0MEDIUM 6.6
CVSS:2.0/AV:L/AC:M/Au:S/C:C/I:C/A:C
References
CVE-2019-6133
MEDIUM6.7

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.

Published: 2019-01-11Modified: 2024-11-21
CVSS 2.0MEDIUM 4.4
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:P/A:P
CVSS 3.xMEDIUM 6.7
CVSS:3.x/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
References