CVE-2019-13313: Infoleak
Published Jul 5, 2019
·Updated
libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line.
Affected Software
14 affected components
libosinfo libosinfo=1.5.0
Fedoraproject Fedora=29
Fedoraproject Fedora=30
redhat Enterprise Linux=8.0
redhat Enterprise Linux Eus=8.1
redhat Enterprise Linux Eus=8.2
redhat Enterprise Linux Eus=8.4
redhat Enterprise Linux Eus=8.6
redhat Enterprise Linux Server Aus=8.2
redhat Enterprise Linux Server Aus=8.4
redhat Enterprise Linux Server Aus=8.6
redhat Enterprise Linux Server Tus=8.2
redhat Enterprise Linux Server Tus=8.4
redhat Enterprise Linux Server Tus=8.6
Remediation
Event History
Jul 5, 2019
CVE Published
via MITRE·01:22 PM
Data Sourced
via MITRE·01:22 PM
Description
Jul 8, 2019
Data Sourced
via Red Hat·06:45 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2019-13313?
CVE-2019-13313 is categorized as a medium severity vulnerability.
2
How do I fix CVE-2019-13313?
To mitigate CVE-2019-13313, update libosinfo to version 1.5.1 or later.
3
What types of systems are affected by CVE-2019-13313?
CVE-2019-13313 affects libosinfo version 1.5.0 and various Fedora and Red Hat Enterprise Linux versions.
4
Can CVE-2019-13313 be exploited locally?
Yes, CVE-2019-13313 can be exploited by local users to discover credentials.
5
What is the main issue with CVE-2019-13313?
The main issue with CVE-2019-13313 is that credentials are exposed via command line arguments when executing osinfo-install-script.