OESA-2022-1502

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1502
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2022-1502.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2022-1502
Upstream
Published
2022-01-27T11:03:29Z
Modified
2025-08-12T05:09:58.456188Z
Summary
polkit security update
Details

Define and Handle authorizations tool.

Security Fix(es):

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.(CVE-2021-4034)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP1 / polkit

Package

Name
polkit
Purl
pkg:rpm/openEuler/polkit&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.116-8.oe1

Ecosystem specific 

{
    "aarch64": [
        "polkit-debugsource-0.116-8.oe1.aarch64.rpm",
        "polkit-libs-0.116-8.oe1.aarch64.rpm",
        "polkit-devel-0.116-8.oe1.aarch64.rpm",
        "polkit-debuginfo-0.116-8.oe1.aarch64.rpm",
        "polkit-0.116-8.oe1.aarch64.rpm"
    ],
    "noarch": [
        "polkit-help-0.116-8.oe1.noarch.rpm"
    ],
    "x86_64": [
        "polkit-0.116-8.oe1.x86_64.rpm",
        "polkit-debuginfo-0.116-8.oe1.x86_64.rpm",
        "polkit-debugsource-0.116-8.oe1.x86_64.rpm",
        "polkit-libs-0.116-8.oe1.x86_64.rpm",
        "polkit-devel-0.116-8.oe1.x86_64.rpm"
    ],
    "src": [
        "polkit-0.116-8.oe1.src.rpm"
    ]
}

openEuler:20.03-LTS-SP2 / polkit

Package

Name
polkit
Purl
pkg:rpm/openEuler/polkit&distro=openEuler-20.03-LTS-SP2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.116-9.oe1

Ecosystem specific 

{
    "aarch64": [
        "polkit-debuginfo-0.116-9.oe1.aarch64.rpm",
        "polkit-devel-0.116-9.oe1.aarch64.rpm",
        "polkit-0.116-9.oe1.aarch64.rpm",
        "polkit-debugsource-0.116-9.oe1.aarch64.rpm",
        "polkit-libs-0.116-9.oe1.aarch64.rpm"
    ],
    "noarch": [
        "polkit-help-0.116-9.oe1.noarch.rpm"
    ],
    "x86_64": [
        "polkit-libs-0.116-9.oe1.x86_64.rpm",
        "polkit-devel-0.116-9.oe1.x86_64.rpm",
        "polkit-debuginfo-0.116-9.oe1.x86_64.rpm",
        "polkit-0.116-9.oe1.x86_64.rpm",
        "polkit-debugsource-0.116-9.oe1.x86_64.rpm"
    ],
    "src": [
        "polkit-0.116-9.oe1.src.rpm"
    ]
}

openEuler:20.03-LTS-SP3 / polkit

Package

Name
polkit
Purl
pkg:rpm/openEuler/polkit&distro=openEuler-20.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.116-9.oe1

Ecosystem specific 

{
    "aarch64": [
        "polkit-0.116-9.oe1.aarch64.rpm",
        "polkit-devel-0.116-9.oe1.aarch64.rpm",
        "polkit-debuginfo-0.116-9.oe1.aarch64.rpm",
        "polkit-libs-0.116-9.oe1.aarch64.rpm",
        "polkit-debugsource-0.116-9.oe1.aarch64.rpm"
    ],
    "noarch": [
        "polkit-help-0.116-9.oe1.noarch.rpm"
    ],
    "x86_64": [
        "polkit-0.116-9.oe1.x86_64.rpm",
        "polkit-debuginfo-0.116-9.oe1.x86_64.rpm",
        "polkit-debugsource-0.116-9.oe1.x86_64.rpm",
        "polkit-libs-0.116-9.oe1.x86_64.rpm",
        "polkit-devel-0.116-9.oe1.x86_64.rpm"
    ],
    "src": [
        "polkit-0.116-9.oe1.src.rpm"
    ]
}