# CVE-2023-3899: dnf-plugin-subscription-manager: The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repos...

CVE-2023-3899 is fixed in 13 products on 1 platform, first by RHSA-2023:4706, released August 22, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-3899
- Priority: High
- CVSS: 7.8 (Important)
- EPSS: 0.0024
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 22, 2023

## Description

The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform.  Security Fix(es):  * subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration (CVE-2023-3899)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | dnf-plugin-subscription-manager RHEL 8 | 0:1.28.36-3.el8_8 | [RHSA-2023:4706](https://patchblox.com/security/data/fix/linux/rhsa-2023-4706.md) | Aug 22, 2023 |
| Linux | dnf-plugin-subscription-manager almalinux 8 | 1.28.36-3.el8_8.alma.1 | [ALSA-2023:4706](https://patchblox.com/security/data/fix/linux/alsa-2023-4706.md) | Aug 22, 2023 |
| Linux | libdnf-plugin-subscription-manager RHEL 9 | 0:1.29.33.1-2.el9_2 | [RHSA-2023:4708](https://patchblox.com/security/data/fix/linux/rhsa-2023-4708.md) | Aug 22, 2023 |
| Linux | libdnf-plugin-subscription-manager almalinux 9 | 1.29.33.1-2.el9_2.alma.1 | [ALSA-2023:4708](https://patchblox.com/security/data/fix/linux/alsa-2023-4708.md) | Aug 22, 2023 |
| Linux | python3-cloud-what RHEL 8 | 0:1.28.36-3.el8_8 | [RHSA-2023:4706](https://patchblox.com/security/data/fix/linux/rhsa-2023-4706.md) | Aug 22, 2023 |
| Linux | python3-cloud-what RHEL 9 | 0:1.29.33.1-2.el9_2 | [RHSA-2023:4708](https://patchblox.com/security/data/fix/linux/rhsa-2023-4708.md) | Aug 22, 2023 |
| Linux | python3-cloud-what almalinux 8 | 1.28.36-3.el8_8.alma.1 | [ALSA-2023:4706](https://patchblox.com/security/data/fix/linux/alsa-2023-4706.md) | Aug 22, 2023 |
| Linux | python3-cloud-what almalinux 9 | 1.29.33.1-2.el9_2.alma.1 | [ALSA-2023:4708](https://patchblox.com/security/data/fix/linux/alsa-2023-4708.md) | Aug 22, 2023 |
| Linux | python3-subscription-manager-rhsm RHEL 8 | 0:1.28.36-3.el8_8 | [RHSA-2023:4706](https://patchblox.com/security/data/fix/linux/rhsa-2023-4706.md) | Aug 22, 2023 |
| Linux | python3-subscription-manager-rhsm RHEL 9 | 0:1.29.33.1-2.el9_2 | [RHSA-2023:4708](https://patchblox.com/security/data/fix/linux/rhsa-2023-4708.md) | Aug 22, 2023 |
| Linux | python3-subscription-manager-rhsm almalinux 8 | 1.28.36-3.el8_8.alma.1 | [ALSA-2023:4706](https://patchblox.com/security/data/fix/linux/alsa-2023-4706.md) | Aug 22, 2023 |
| Linux | python3-subscription-manager-rhsm almalinux 9 | 1.29.33.1-2.el9_2.alma.1 | [ALSA-2023:4708](https://patchblox.com/security/data/fix/linux/alsa-2023-4708.md) | Aug 22, 2023 |
| Linux | python3-syspurpose RHEL 8 | 0:1.28.36-3.el8_8 | [RHSA-2023:4706](https://patchblox.com/security/data/fix/linux/rhsa-2023-4706.md) | Aug 22, 2023 |
| Linux | python3-syspurpose almalinux 8 | 1.28.36-3.el8_8.alma.1 | [ALSA-2023:4706](https://patchblox.com/security/data/fix/linux/alsa-2023-4706.md) | Aug 22, 2023 |
| Linux | rhsm-gtk RHEL 8 | 0:1.28.36-3.el8_8 | [RHSA-2023:4706](https://patchblox.com/security/data/fix/linux/rhsa-2023-4706.md) | Aug 22, 2023 |
| Linux | rhsm-icons RHEL 8 | 0:1.28.36-3.el8_8 | [RHSA-2023:4706](https://patchblox.com/security/data/fix/linux/rhsa-2023-4706.md) | Aug 22, 2023 |
| Linux | subscription-manager RHEL 8 | 0:1.28.36-3.el8_8 | [RHSA-2023:4706](https://patchblox.com/security/data/fix/linux/rhsa-2023-4706.md) | Aug 22, 2023 |
| Linux | subscription-manager RHEL 9 | 0:1.29.33.1-2.el9_2 | [RHSA-2023:4708](https://patchblox.com/security/data/fix/linux/rhsa-2023-4708.md) | Aug 22, 2023 |
| Linux | subscription-manager almalinux 8 | 1.28.36-3.el8_8.alma.1 | [ALSA-2023:4706](https://patchblox.com/security/data/fix/linux/alsa-2023-4706.md) | Aug 22, 2023 |
| Linux | subscription-manager almalinux 9 | 1.29.33.1-2.el9_2.alma.1 | [ALSA-2023:4708](https://patchblox.com/security/data/fix/linux/alsa-2023-4708.md) | Aug 22, 2023 |
| Linux | subscription-manager rocky 8 | 0:1.28.36-3.el8_8.rocky.0.1 | [RLSA-2023:4706](https://patchblox.com/security/data/fix/linux/rlsa-2023-4706.md) | Aug 28, 2023 |
| Linux | subscription-manager rocky 9 | 0:1.29.33.1-2.el9_2.rocky.0.1 | [RLSA-2023:4708](https://patchblox.com/security/data/fix/linux/rlsa-2023-4708.md) | Aug 24, 2023 |
| Linux | subscription-manager-cockpit RHEL 8 | 0:1.28.36-3.el8_8 | [RHSA-2023:4706](https://patchblox.com/security/data/fix/linux/rhsa-2023-4706.md) | Aug 22, 2023 |
| Linux | subscription-manager-initial-setup-addon RHEL 8 | 0:1.28.36-3.el8_8 | [RHSA-2023:4706](https://patchblox.com/security/data/fix/linux/rhsa-2023-4706.md) | Aug 22, 2023 |
| Linux | subscription-manager-migration RHEL 8 | 0:1.28.36-3.el8_8 | [RHSA-2023:4706](https://patchblox.com/security/data/fix/linux/rhsa-2023-4706.md) | Aug 22, 2023 |
| Linux | subscription-manager-migration almalinux 8 | 1.28.36-3.el8_8.alma.1 | [ALSA-2023:4706](https://patchblox.com/security/data/fix/linux/alsa-2023-4706.md) | Aug 22, 2023 |
| Linux | subscription-manager-plugin-ostree RHEL 8 | 0:1.28.36-3.el8_8 | [RHSA-2023:4706](https://patchblox.com/security/data/fix/linux/rhsa-2023-4706.md) | Aug 22, 2023 |
| Linux | subscription-manager-plugin-ostree RHEL 9 | 0:1.29.33.1-2.el9_2 | [RHSA-2023:4708](https://patchblox.com/security/data/fix/linux/rhsa-2023-4708.md) | Aug 22, 2023 |
| Linux | subscription-manager-plugin-ostree almalinux 8 | 1.28.36-3.el8_8.alma.1 | [ALSA-2023:4706](https://patchblox.com/security/data/fix/linux/alsa-2023-4706.md) | Aug 22, 2023 |
| Linux | subscription-manager-plugin-ostree almalinux 9 | 1.29.33.1-2.el9_2.alma.1 | [ALSA-2023:4708](https://patchblox.com/security/data/fix/linux/alsa-2023-4708.md) | Aug 22, 2023 |
| Linux | subscription-manager-rhsm-certificates RHEL 8 | 0:1.28.36-3.el8_8 | [RHSA-2023:4706](https://patchblox.com/security/data/fix/linux/rhsa-2023-4706.md) | Aug 22, 2023 |
| Linux | subscription-manager-rhsm-certificates almalinux 8 | 1.28.36-3.el8_8.alma.1 | [ALSA-2023:4706](https://patchblox.com/security/data/fix/linux/alsa-2023-4706.md) | Aug 22, 2023 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.