CVE-2019-12749 json
dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in s…
published 7y ago modified 4mo ago also EUVD-2019-4335
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.
Patch / fix
- freedesktop dbus 1.10.28, 1.12.16, 1.13.12
- dbus Debian 14, Debian 13, Debian 12 1.12.16-1
debian advisories DEBIAN-CVE-2019-12749
- dbus Ubuntu 16.04 LTS 1.10.6-1ubuntu3.4
- dbus Ubuntu 18.04 LTS 1.12.2-1ubuntu1.1
- dbus Ubuntu Pro 14.04 LTS 1.6.18-0ubuntu4.5+esm1
ubuntu advisories UBUNTU-CVE-2019-12749
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- dbus RHEL 7 1:1.10.24-15.el7
- dbus-x11 RHEL 7 1:1.10.24-15.el7
- dbus-libs RHEL 7 1:1.10.24-15.el7
- dbus-tests RHEL 7 1:1.10.24-15.el7
- dbus RHEL 8 1:1.12.8-9.el8
- dbus-x11 RHEL 8 1:1.12.8-9.el8
- dbus-libs RHEL 8 1:1.12.8-9.el8
- dbus-tools RHEL 8 1:1.12.8-9.el8
red hat advisories RHSA-2020:4032RHSA-2019:3707RHSA-2019:1726RHSA-2019:2868RHSA-2019:2870
- dbus-1 SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.8.22-11.3.1
- dbus-1-x11 SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.8.22-11.3.1
- dbus-1 SLES for SAP 12 SP3, OpenStack Cloud Crowbar 8, OpenStack Cloud 8 +2 more 1.8.22-29.17.7
- dbus-1-x11 SLES for SAP 12 SP3, OpenStack Cloud Crowbar 8, OpenStack Cloud 8 +2 more 1.8.22-29.17.12
- dbus-1 SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 1.2.10-3.34.8.1
- dbus-1-x11 SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 1.2.10-3.34.8.1
- dbus-1 SLE Module for Basesystem 15 1.12.2-3.8.1
- dbus-1-x11 SLE Module for Basesystem 15 1.12.2-3.8.1
suse advisories SUSE-SU-2020:1672-1SUSE-SU-2019:2820-2SUSE-SU-2019:14111-1SUSE-SU-2019:1597-1SUSE-SU-2019:1595-1SUSE-SU-2019:1591-1
- dbus-1 openSUSE Tumbleweed 1.12.20-5.5
- dbus-1 openSUSE Leap 15.1 1.12.2-lp151.4.3.1
- dbus-1-x11 openSUSE Leap 15.1 1.12.2-lp151.4.3.1
- dbus-1 openSUSE Leap 15.0 1.12.2-lp150.2.4.2
- dbus-1-x11 openSUSE Leap 15.0 1.12.2-lp150.2.4.2
- dbus-1 openSUSE Leap 15.0 1.12.2-lp150.2.3.1
- dbus-1-x11 openSUSE Leap 15.0 1.12.2-lp150.2.3.1
opensuse advisories openSUSE-SU-2024:10711-1openSUSE-SU-2019:1750-1openSUSE-SU-2019:1671-1openSUSE-SU-2019:1604-1
- dbus Alpine 3.24, Alpine 3.23, Alpine 3.22 +12 more 1.12.16-r0
- dbus Alpine 3.9, Alpine 3.8, Alpine 3.7 1.10.28-r0
alpine advisories ALPINE-CVE-2019-12749
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- dbus CBL-Mariner 2.0 1.13.6-9
azure linux advisories AZL-6371
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- dbus Arch Linux 1.12.16-1
arch linux advisories AVG-974
Is CVE-2019-12749 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2019-12749 updated cvss 7.0
dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass
-
Red Hat Enterprise Linux 5 dbusaffected: no fix planned “Out of support scope”
-
Red Hat OpenShift Do 1 openshiftdo/odo-init-image-rhel7 1.1.3-2fixed: vendor fix RHSA-2021:0949
-
Red Hat Enterprise Linux AppStream (v. 8) dbus-x11 1.12.8-9.el8 Red Hat Enterprise Linux BaseOS (v. 8) dbus 1.12.8-9.el8, dbus-libs 1.12.8-9.el8, dbus-tools 1.12.8-9.el8, dbus-common 1.12.8-9.el8, dbus-daemon 1.12.8-9.el8fixed: vendor fix RHSA-2019:3707
-
Red Hat Enterprise Linux Client (v. 7) dbus 1.10.24-15.el7, dbus-x11 1.10.24-15.el7, dbus-libs 1.10.24-15.el7 Red Hat Enterprise Linux Client Optional (v. 7) dbus-tests 1.10.24-15.el7 Red Hat Enterprise Linux ComputeNode (v. 7) dbus 1.10.24-15.el7, dbus-x11 1.10.24-15.el7, dbus-libs 1.10.24-15.el7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) dbus-tests 1.10.24-15.el7fixed: vendor fix RHSA-2020:4032
-
Red Hat Enterprise Linux Desktop (v. 6) dbus 1.2.24-11.el6_10, dbus-x11 1.2.24-11.el6_10, dbus-libs 1.2.24-11.el6_10 Red Hat Enterprise Linux Desktop Optional (v. 6) dbus-doc 1.2.24-11.el6_10, dbus-devel 1.2.24-11.el6_10, dbus-debuginfo 1.2.24-11.el6_10 Red Hat Enterprise Linux HPC Node (v. 6) dbus 1.2.24-11.el6_10, dbus-x11 1.2.24-11.el6_10, dbus-libs 1.2.24-11.el6_10 Red Hat Enterprise Linux HPC Node Optional (v. 6) dbus-doc 1.2.24-11.el6_10, dbus-devel 1.2.24-11.el6_10, dbus-debuginfo 1.2.24-11.el6_10 Red Hat Enterprise Linux Server (v. 6) dbus 1.2.24-11.el6_10, dbus-x11 1.2.24-11.el6_10, dbus-libs 1.2.24-11.el6_10fixed: vendor fix RHSA-2019:1726
-
Red Hat Enterprise Linux Server (v. 7) dbus 1.10.24-15.el7, dbus-x11 1.10.24-15.el7, dbus-libs 1.10.24-15.el7fixed: vendor fix RHSA-2020:4032
-
Red Hat Enterprise Linux Server AUS (v. 6.5) dbus 1.2.24-9.el6_5, dbus-x11 1.2.24-9.el6_5, dbus-libs 1.2.24-9.el6_5fixed: vendor fix RHSA-2019:2870
-
Red Hat Enterprise Linux Server AUS (v. 6.6) dbus 1.2.24-9.el6_6, dbus-x11 1.2.24-9.el6_6, dbus-libs 1.2.24-9.el6_6fixed: vendor fix RHSA-2019:2868
show 8 moreshow fewer
-
Red Hat Enterprise Linux Server Optional (v. 6) dbus-doc 1.2.24-11.el6_10fixed: vendor fix RHSA-2019:1726
-
Red Hat Enterprise Linux Server Optional (v. 7) dbus-tests 1.10.24-15.el7fixed: vendor fix RHSA-2020:4032
-
Red Hat Enterprise Linux Server Optional AUS (v. 6.5) dbus 1.2.24-9.el6_5fixed: vendor fix RHSA-2019:2870
-
Red Hat Enterprise Linux Server Optional AUS (v. 6.6) dbus-doc 1.2.24-9.el6_6fixed: vendor fix RHSA-2019:2868
-
Red Hat Enterprise Linux Workstation (v. 6) dbus 1.2.24-11.el6_10, dbus-x11 1.2.24-11.el6_10, dbus-libs 1.2.24-11.el6_10fixed: vendor fix RHSA-2019:1726
-
Red Hat Enterprise Linux Workstation (v. 7) dbus 1.10.24-15.el7, dbus-x11 1.10.24-15.el7, dbus-libs 1.10.24-15.el7fixed: vendor fix RHSA-2020:4032
-
Red Hat Enterprise Linux Workstation Optional (v. 6) dbus-doc 1.2.24-11.el6_10fixed: vendor fix RHSA-2019:1726
-
Red Hat Enterprise Linux Workstation Optional (v. 7) dbus-tests 1.10.24-15.el7fixed: vendor fix RHSA-2020:4032
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 8mo ago
Exploit prediction
0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVD | 3.0 | 7.1 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 3.6 | AV:L/AC:L/Au:N/C:P/I:P/A:N |
Classification
- Weakness
-
- CWE-59 Improper Link Resolution Before File Access
References
-
usn.ubuntu.com
/4015-1/
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/4015-2/
vendor-advisory
-
debian.org
/security/2019/dsa-4462
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/V2CQF37O73VH2JDVX2ILX2KD2KLXLQOU/
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-06/msg00059.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-06/msg00092.html
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:1726
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2019-07/msg00026.html
vendor-advisory
-
security.gentoo.org
/glsa/201909-08
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:2868
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:2870
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:3707
vendor-advisory
-
openwall.com
/lists/oss-security/2019/06/11/2
mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2019/06/11/2
mailing-list, mitigation, third-party-advisory
-
seclists.org
/bugtraq/2019/Jun/16
mailing-list
-
securityfocus.com
/bid/108751
vdb-entry
-
lists.debian.org
/debian-lts-announce/2019/06/msg00005.html
mailing-list
- security.netapp.com /advisory/ntap-20241206-0010/
Sources
- CVE List CVE-2019-12749
- NVD CVE-2019-12749
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.