CVE-2018-1106

NONE EPSS 31.2%

Published Apr 23, 20188y ago · Modified Jun 17, 20262w ago

Published Apr 23, 2018 8y ago

Last Modified Jun 17, 2026 2w ago

Description

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.

Threat Intelligence

EPSS Exploit Probability

31.2% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-287 Improper Authentication Authentication

Affected Products 10

Vendor	Product	Version	Range
packagekit_project	packagekit	*	<1.1.10
redhat	enterprise_linux_desktop	7.0	any
redhat	enterprise_linux_server	7.0	any
redhat	enterprise_linux_server_aus	7.6	any
redhat	enterprise_linux_server_eus	7.5	any
redhat	enterprise_linux_server_eus	7.6	any
redhat	enterprise_linux_server_tus	7.6	any
redhat	enterprise_linux_workstation	7.0	any
canonical	ubuntu_linux	17.10	any
debian	debian_linux	9.0	any

References 5

openwall.com http://www.openwall.com/lists/oss-security/2018/04/23/3

Mailing ListThird Party Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2018:1224

Third Party Advisory
bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1565992

Issue TrackingThird Party Advisory
usn.ubuntu.com https://usn.ubuntu.com/3634-1/

Third Party Advisory
debian.org https://www.debian.org/security/2018/dsa-4207

Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.