Moderate: dbus-broker security update
Summary
ALSA-2022:6608: Moderate: dbus-broker security update. Affects dbus-broker versions < 28-5.1.el9_0. Fixed in 28-5.1.el9_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
dbus-broker is an implementation of a message bus as defined by the D-Bus specification. It is designed for Linux systems and utilizes modern features provided by recent Linux kernel releases. The aim of dbus-broker is to provide high performance and reliability while maintaining compatibility with the D-Bus reference implementation.
Vulnerability Detail
The dbus-broker package is affected by two security vulnerabilities:
-
CVE-2022-31212: This vulnerability is a stack buffer over-read that occurs when a malicious Exec line is supplied. An attacker can exploit this issue to read sensitive information from the stack, potentially leading to further attacks.
-
CVE-2022-31213: This vulnerability is a null pointer reference that occurs when a malformed XML config file is supplied. A remote attacker can exploit this issue to cause a denial of service (DoS) condition by crashing the dbus-broker service.
How To Fix
Minimum fixed version
28-5.1.el9_0
This is the first release that contains the fix.
sudo dnf update dbus-brokerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
dbus-broker is affected by two security vulnerabilities that can result in the disclosure of sensitive information and a denial of service (DoS) condition. It is recommended to update the dbus-broker package to version 28-5.1.el9_0 or later to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dbus-broker →
FAQ
dbus-broker is an implementation of a message bus as defined by the D-Bus specification. It provides high performance and reliability for Linux systems.
CVE-2022-31212 is a stack buffer over-read vulnerability in dbus-broker. It can be exploited by supplying a malicious Exec line, potentially leading to the disclosure of sensitive information.
CVE-2022-31213 is a null pointer reference vulnerability in dbus-broker. It can be exploited by supplying a malformed XML config file, resulting in a denial of service (DoS) condition.
The stack buffer over-read vulnerability (CVE-2022-31212) can lead to the disclosure of sensitive information, while the null pointer reference vulnerability (CVE-2022-31213) can cause a denial of service (DoS) condition.
To fix these vulnerabilities, update the dbus-broker package to version 28-5.1.el9_0 or later.
Related vulnerabilities
Recent vulnerabilities recorded for dbus-broker.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
