It was discovered that sealert executed external fix commands using commands.getstatusoutput() without properly sanitizing untrusted inputs used as command arguments. These inputs originated from SELinux AVC messages. A local user could use this flaw to execute arbitrary code as root if they could trigger an SELinux denial using a file with a specially crafted name.

The use of commands.getstatusoutput() was already removed upstream via the following commit:

https://github.com/fedora-selinux/setroubleshoot/commit/2d12677629ca319310f6263688bb1b7f676c01b7

It was reported that execmod and execstack setroubleshoot plugins use commands.getstatusoutput("... %s ...") which can be misused in such a way when appropriate setroubleshoot plugin analyzes the AVC triggered by binary, setroubleshoot daemon executes arbitrary commands which are part of the binary filename.

Product bug:

https://bugzilla.redhat.com/showbug.cgi?id=1332411