Security Bulletin: Red Hat Universal Base Image Minimal UBI Publicly disclosed vulnerability

Summary

Red Hat Universal Base Image Minimal UBI Publicly disclosed vulnerability, the ubi8 containers that the MAS Core team maintains will all be rebuilt using the latest ubi8 version that is available.

Vulnerability Details

CVEID:CVE-2023-3899
**DESCRIPTION:**Red Hat Enterprise Linux could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper authorization by the subscription-manager. By sending a specially crafted request through D-Bus interface com.redhat.RHSM1, an authenticated attacker could exploit this vulnerability to gain elevated privileges to an unconfined root.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/264328 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

ibm-mas-predict.v9.0

ibm-mas-health.v9.0

ibm-mas-health.v8.11.x

ibm-mas-predict.v8.9.x

Workarounds and Mitigations

None