Red Hat Enterprise Linux (CPython): Schwachstelle ermöglicht Manipulation von Dateien
WID-SEC-2024-2033 · first 03.09.2024 · updated 10.07.2026 · CVSS 6,8
What it is about
Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution. Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um Dateien zu manipulieren.
Under what conditions?
Over the network, but only with valid access (login required), for example with stolen credentials or as an insider.
What can happen in the worst case
An attacker could use the vulnerability to
- Dateien zu manipulieren
Am I affected?
Affected according to the BSI:
- Debian Linux
- Amazon Linux 2
- Red Hat Enterprise Linux
- Fedora Linux
- Ubuntu Linux
- SUSE Linux
- Oracle Linux
- Gentoo Linux
- IBM SPSS Modeler
- NetApp ActiveIQ Unified Manager for VMware vSphere
- NetApp ActiveIQ Unified Manager for Microsoft Windows
- SUSE openSUSE
and 10 more
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Red Hat Enterprise Linux CPython 3.12.1
- Dell PowerScale OneFS OneFS 9.5.1.2
- Dell PowerProtect Data Domain 8.4.0.0
- Dell PowerProtect Data Domain 7.10.1.70
- Dell PowerProtect Data Domain 7.13.1.40
- Dell PowerProtect Data Domain 8.3.1.10
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- NIST Vulnerability Database vom 2024-09-02 nvd.nist.gov
- Red Hat Security Advisory vom 2024-09-02 access.redhat.com
- SuSE Security Advisory vom 2024-09-02 lists.suse.com
- Bug Report und PoC github.com
- Red Hat Security Advisory RHSA-2024:6179 vom 2024-09-04 access.redhat.com
- Oracle Linux Security Advisory ELSA-2024-6146 vom 2024-09-03 linux.oracle.com
- Oracle Linux Security Advisory ELSA-2024-6163 vom 2024-09-03 linux.oracle.com
- Red Hat Security Advisory RHSA-2024:6163 vom 2024-09-04 access.redhat.com
- Oracle Linux Security Advisory ELSA-2024-6179 vom 2024-09-03 linux.oracle.com
- SUSE Security Update SUSE-SU-2024:3200-1 vom 2024-09-11 lists.suse.com
- Fedora Security Advisory FEDORA-2024-37D9C902DD vom 2024-09-11 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2024-7A069F48E4 vom 2024-09-11 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2024-308628EBB8 vom 2024-09-11 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2024-6DEDBC5CF9 vom 2024-09-11 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2024-1E6D6F8452 vom 2024-09-11 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2024-7DB9258D37 vom 2024-09-11 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2024-F652468298 vom 2024-09-11 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2024-AE2925C3AE vom 2024-09-11 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2024-F7F36C20A2 vom 2024-09-11 bodhi.fedoraproject.org
- Rocky Linux Security Advisory RLSA-2024:6146 vom 2024-09-17 errata.build.resf.org
- SUSE Security Update SUSE-SU-2024:3293-1 vom 2024-09-18 lists.suse.com
- SUSE Security Update SUSE-SU-2024:3294-1 vom 2024-09-18 lists.suse.com
- SUSE Security Update SUSE-SU-2024:3302-1 vom 2024-09-18 lists.suse.com
- SUSE Security Update SUSE-SU-2024:3303-1 vom 2024-09-18 lists.suse.com
- Red Hat Security Advisory RHSA-2024:6909 vom 2024-09-23 access.redhat.com
and 48 more sources in the original advisory
CVE: CVE-2024-6923
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.