Moderate: usbguard security update
Summary
ALSA-2023:0303: Moderate: usbguard security update. Affects usbguard versions < 1.0.0-10.el9_1.2. Fixed in 1.0.0-10.el9_1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The USBGuard software framework provides system protection against intrusive USB devices by implementing basic whitelisting and blacklisting capabilities based on device attributes. To enforce a user-defined policy, USBGuard uses the Linux kernel USB device authorization feature.
Vulnerability Detail
The usbguard package is affected by a vulnerability that allows unauthorized access via D-Bus. This vulnerability, identified as CVE-2019-25058, can potentially lead to unauthorized actions being performed on the system by an attacker with access to the D-Bus interface. The impact of this vulnerability can vary depending on the privileges associated with the D-Bus interface and the actions allowed by the usbguard configuration.
How To Fix
Minimum fixed version
1.0.0-10.el9_1.2
This is the first release that contains the fix.
sudo dnf update usbguardTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the usbguard package is affected by a vulnerability that allows unauthorized access via D-Bus. To mitigate this vulnerability, it is important to update the usbguard package to version 1.0.0-10.el9_1.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for usbguard →
FAQ
USBGuard is a software framework that provides protection against intrusive USB devices by implementing whitelisting and blacklisting capabilities based on device attributes.
The vulnerability allows unauthorized access via D-Bus, which can potentially lead to unauthorized actions being performed on the system by an attacker with access to the D-Bus interface.
To fix this vulnerability, update the usbguard package to version 1.0.0-10.el9_1.2 or later.
The update can be obtained from the official AlmaLinux repositories or through the package manager of the operating system.
No specific workaround has been provided for this vulnerability. It is recommended to update the usbguard package to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for usbguard.
