Security update for polkit SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:2035-2 Final 1 1 2019-08-01T15:35:16Z current 2019-08-01T15:35:16Z 2019-08-01T15:35:16Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for polkit This update for polkit fixes the following issues: Security issue fixed: - CVE-2019-6133: Fixed improper caching of auth decisions, which could bypass uid checking in the interactive backend (bsc#1121826). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP4-Azure-BYOS-2019-2035,Image SLES12-SP4-EC2-HVM-BYOS-2019-2035,Image SLES12-SP4-GCE-BYOS-2019-2035,Image SLES12-SP4-OCI-BYOS-2019-2035,Image SLES12-SP4-SAP-Azure-2019-2035,Image SLES12-SP4-SAP-Azure-BYOS-2019-2035,Image SLES12-SP4-SAP-Azure-LI-BYOS-Production-2019-2035,Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production-2019-2035,Image SLES12-SP4-SAP-EC2-HVM-2019-2035,Image SLES12-SP4-SAP-EC2-HVM-BYOS-2019-2035,Image SLES12-SP4-SAP-GCE-2019-2035,Image SLES12-SP4-SAP-GCE-BYOS-2019-2035,Image SLES12-SP4-SAP-OCI-BYOS-2019-2035,Image SLES12-SP5-Azure-BYOS-2019-2035,Image SLES12-SP5-Azure-Basic-On-Demand-2019-2035,Image SLES12-SP5-Azure-HPC-BYOS-2019-2035,Image SLES12-SP5-Azure-HPC-On-Demand-2019-2035,Image SLES12-SP5-Azure-SAP-BYOS-2019-2035,Image SLES12-SP5-Azure-SAP-On-Demand-2019-2035,Image SLES12-SP5-Azure-Standard-On-Demand-2019-2035,Image SLES12-SP5-EC2-BYOS-2019-2035,Image SLES12-SP5-EC2-ECS-On-Demand-2019-2035,Image SLES12-SP5-EC2-On-Demand-2019-2035,Image SLES12-SP5-EC2-SAP-BYOS-2019-2035,Image SLES12-SP5-EC2-SAP-On-Demand-2019-2035,Image SLES12-SP5-GCE-BYOS-2019-2035,Image SLES12-SP5-GCE-On-Demand-2019-2035,Image SLES12-SP5-GCE-SAP-BYOS-2019-2035,Image SLES12-SP5-GCE-SAP-On-Demand-2019-2035,Image SLES12-SP5-OCI-BYOS-BYOS-2019-2035,Image SLES12-SP5-OCI-BYOS-SAP-BYOS-2019-2035,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2019-2035,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2019-2035,SUSE-2019-2035,SUSE-Storage-5-2019-2035 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20192035-2/ Link for SUSE-SU-2019:2035-2 https://lists.suse.com/pipermail/sle-security-updates/2019-August/005819.html E-Mail link for SUSE-SU-2019:2035-2 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1121826 SUSE Bug 1121826 https://www.suse.com/security/cve/CVE-2019-6133/ SUSE CVE CVE-2019-6133 page Image SLES12-SP4-Azure-BYOS Image SLES12-SP4-EC2-HVM-BYOS Image SLES12-SP4-GCE-BYOS Image SLES12-SP4-OCI-BYOS Image SLES12-SP4-SAP-Azure Image SLES12-SP4-SAP-Azure-BYOS Image SLES12-SP4-SAP-Azure-LI-BYOS-Production Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production Image SLES12-SP4-SAP-EC2-HVM Image SLES12-SP4-SAP-EC2-HVM-BYOS Image SLES12-SP4-SAP-GCE Image SLES12-SP4-SAP-GCE-BYOS Image SLES12-SP4-SAP-OCI-BYOS Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-Basic-On-Demand Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-OCI-BYOS-BYOS Image SLES12-SP5-OCI-BYOS-SAP-BYOS Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Enterprise Storage 5 libpolkit0-0.113-5.18.1 polkit-0.113-5.18.1 libpolkit0-32bit-0.113-5.18.1 libpolkit0-64bit-0.113-5.18.1 polkit-devel-0.113-5.18.1 polkit-doc-0.113-5.18.1 typelib-1_0-Polkit-1_0-0.113-5.18.1 libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP4-Azure-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP4-Azure-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP4-EC2-HVM-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP4-EC2-HVM-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP4-GCE-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP4-GCE-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP4-OCI-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP4-OCI-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-Azure polkit-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-Azure libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-Azure-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-Azure-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-Azure-LI-BYOS-Production polkit-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-Azure-LI-BYOS-Production libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production polkit-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-EC2-HVM polkit-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-EC2-HVM libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-EC2-HVM-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-EC2-HVM-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-GCE polkit-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-GCE libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-GCE-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-GCE-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-OCI-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP4-SAP-OCI-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-Azure-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP5-Azure-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand polkit-0.113-5.18.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand polkit-0.113-5.18.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand polkit-0.113-5.18.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand polkit-0.113-5.18.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-EC2-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP5-EC2-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand polkit-0.113-5.18.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-EC2-On-Demand polkit-0.113-5.18.1 as a component of Image SLES12-SP5-EC2-On-Demand libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand polkit-0.113-5.18.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-GCE-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP5-GCE-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-GCE-On-Demand polkit-0.113-5.18.1 as a component of Image SLES12-SP5-GCE-On-Demand libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand polkit-0.113-5.18.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-OCI-BYOS-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP5-OCI-BYOS-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-OCI-BYOS-SAP-BYOS polkit-0.113-5.18.1 as a component of Image SLES12-SP5-OCI-BYOS-SAP-BYOS libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production polkit-0.113-5.18.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production libpolkit0-0.113-5.18.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production polkit-0.113-5.18.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production libpolkit0-0.113-5.18.1 as a component of SUSE Enterprise Storage 5 polkit-0.113-5.18.1 as a component of SUSE Enterprise Storage 5 typelib-1_0-Polkit-1_0-0.113-5.18.1 as a component of SUSE Enterprise Storage 5 In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c. CVE-2019-6133 Image SLES12-SP4-Azure-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP4-Azure-BYOS:polkit-0.113-5.18.1 Image SLES12-SP4-EC2-HVM-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP4-EC2-HVM-BYOS:polkit-0.113-5.18.1 Image SLES12-SP4-GCE-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP4-GCE-BYOS:polkit-0.113-5.18.1 Image SLES12-SP4-OCI-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP4-OCI-BYOS:polkit-0.113-5.18.1 Image SLES12-SP4-SAP-Azure-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP4-SAP-Azure-BYOS:polkit-0.113-5.18.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:libpolkit0-0.113-5.18.1 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:polkit-0.113-5.18.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:libpolkit0-0.113-5.18.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:polkit-0.113-5.18.1 Image SLES12-SP4-SAP-Azure:libpolkit0-0.113-5.18.1 Image SLES12-SP4-SAP-Azure:polkit-0.113-5.18.1 Image SLES12-SP4-SAP-EC2-HVM-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP4-SAP-EC2-HVM-BYOS:polkit-0.113-5.18.1 Image SLES12-SP4-SAP-EC2-HVM:libpolkit0-0.113-5.18.1 Image SLES12-SP4-SAP-EC2-HVM:polkit-0.113-5.18.1 Image SLES12-SP4-SAP-GCE-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP4-SAP-GCE-BYOS:polkit-0.113-5.18.1 Image SLES12-SP4-SAP-GCE:libpolkit0-0.113-5.18.1 Image SLES12-SP4-SAP-GCE:polkit-0.113-5.18.1 Image SLES12-SP4-SAP-OCI-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP4-SAP-OCI-BYOS:polkit-0.113-5.18.1 Image SLES12-SP5-Azure-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP5-Azure-BYOS:polkit-0.113-5.18.1 Image SLES12-SP5-Azure-Basic-On-Demand:libpolkit0-0.113-5.18.1 Image SLES12-SP5-Azure-Basic-On-Demand:polkit-0.113-5.18.1 Image SLES12-SP5-Azure-HPC-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP5-Azure-HPC-BYOS:polkit-0.113-5.18.1 Image SLES12-SP5-Azure-HPC-On-Demand:libpolkit0-0.113-5.18.1 Image SLES12-SP5-Azure-HPC-On-Demand:polkit-0.113-5.18.1 Image SLES12-SP5-Azure-SAP-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP5-Azure-SAP-BYOS:polkit-0.113-5.18.1 Image SLES12-SP5-Azure-SAP-On-Demand:libpolkit0-0.113-5.18.1 Image SLES12-SP5-Azure-SAP-On-Demand:polkit-0.113-5.18.1 Image SLES12-SP5-Azure-Standard-On-Demand:libpolkit0-0.113-5.18.1 Image SLES12-SP5-Azure-Standard-On-Demand:polkit-0.113-5.18.1 Image SLES12-SP5-EC2-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP5-EC2-BYOS:polkit-0.113-5.18.1 Image SLES12-SP5-EC2-ECS-On-Demand:libpolkit0-0.113-5.18.1 Image SLES12-SP5-EC2-ECS-On-Demand:polkit-0.113-5.18.1 Image SLES12-SP5-EC2-On-Demand:libpolkit0-0.113-5.18.1 Image SLES12-SP5-EC2-On-Demand:polkit-0.113-5.18.1 Image SLES12-SP5-EC2-SAP-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP5-EC2-SAP-BYOS:polkit-0.113-5.18.1 Image SLES12-SP5-EC2-SAP-On-Demand:libpolkit0-0.113-5.18.1 Image SLES12-SP5-EC2-SAP-On-Demand:polkit-0.113-5.18.1 Image SLES12-SP5-GCE-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP5-GCE-BYOS:polkit-0.113-5.18.1 Image SLES12-SP5-GCE-On-Demand:libpolkit0-0.113-5.18.1 Image SLES12-SP5-GCE-On-Demand:polkit-0.113-5.18.1 Image SLES12-SP5-GCE-SAP-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP5-GCE-SAP-BYOS:polkit-0.113-5.18.1 Image SLES12-SP5-GCE-SAP-On-Demand:libpolkit0-0.113-5.18.1 Image SLES12-SP5-GCE-SAP-On-Demand:polkit-0.113-5.18.1 Image SLES12-SP5-OCI-BYOS-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP5-OCI-BYOS-BYOS:polkit-0.113-5.18.1 Image SLES12-SP5-OCI-BYOS-SAP-BYOS:libpolkit0-0.113-5.18.1 Image SLES12-SP5-OCI-BYOS-SAP-BYOS:polkit-0.113-5.18.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libpolkit0-0.113-5.18.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:polkit-0.113-5.18.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libpolkit0-0.113-5.18.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:polkit-0.113-5.18.1 SUSE Enterprise Storage 5:libpolkit0-0.113-5.18.1 SUSE Enterprise Storage 5:polkit-0.113-5.18.1 SUSE Enterprise Storage 5:typelib-1_0-Polkit-1_0-0.113-5.18.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192035-2/ https://www.suse.com/security/cve/CVE-2019-6133.html CVE-2019-6133 https://bugzilla.suse.com/1070943 SUSE Bug 1070943 https://bugzilla.suse.com/1121826 SUSE Bug 1121826 https://bugzilla.suse.com/1121872 SUSE Bug 1121872