CVEvulnerability

CVE-2019-15718

4.4 MEDIUM Published 2019-09-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-09-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.4 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.6 LOW — AV:L/AC:L/Au:N/C:P/I:P/A:N

Description

In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.

Affected configurations

• systemd project systemd 240 • fedoraproject fedora 29 • fedoraproject fedora 30 • fedoraproject fedora 31 • redhat openshift container platform 4.1 • redhat enterprise linux 8.0 • redhat enterprise linux eus 8.1 • redhat enterprise linux eus 8.2 • redhat enterprise linux eus 8.4 • redhat enterprise linux for ibm z systems 8 s390x • redhat enterprise linux for ibm z systems eus 8.1 • redhat enterprise linux for ibm z systems eus 8.2 • redhat enterprise linux for ibm z systems eus 8.4 • redhat enterprise linux for ibm z systems eus s390x 8.1 • redhat enterprise linux for ibm z systems eus s390x 8.2 • redhat enterprise linux for power little endian 8.0 • redhat enterprise linux for power little endian eus 8.1 • redhat enterprise linux for power little endian eus 8.2 • redhat enterprise linux for power little endian eus 8.4 • redhat enterprise linux server aus 8.2 • redhat enterprise linux server aus 8.4 • redhat enterprise linux server for power little endian update services for sap solutions 8.1 • redhat enterprise linux server for power little endian update services for sap solutions 8.2 • redhat enterprise linux server for power little endian update services for sap solutions 8.4 • redhat enterprise linux server tus 8.2 • redhat enterprise linux server tus 8.4 • redhat enterprise linux server update services for sap solutions 8.1 • redhat enterprise linux server update services for sap solutions 8.2 • redhat enterprise linux server update services for sap solutions 8.4

References