Advisory ROSA-SA-2022-2012

Software: polkit 0.112
OS: rosa-server79

package_evr_string: polkit-0.112-26

CVE-ID: CVE-2021-4034
BDU-ID: 2022-00488
CVE-Crit: HIGH
CVE-DESC: There is an issue in pkexec that causes it to not check the number of arguments, assuming that it will always be at least 1 and that the second value is equal to NULL or the command that pkexec should execute as a privileged user. If the attacker successfully forces the argument array to be empty, this means that pkexec will interpret the contents from the environment array as the application to be executed. An attacker can exploit this by manipulating these variables to contain certain values and useful data, allowing it to be executed as a privileged user without requesting any authentication.
CVE-STATUS: Fixed
CVE-REV: Run the yum update polkit command to close it