CVE-2019-13313

HIGH 7.8CVE-2019-13313 · Published 05/07/2019 · updated 17/06/2026

In short

CVE-2019-13313 is a HIGH (CVSS 7.8) vulnerability affecting libosinfo (libosinfo).
Chance of exploitation in the next 30 days (EPSS): 0.43%, higher than 37.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
libosinfo libosinfo	`= 1.5.0`	No fix yet

Description

libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line.

References

openwall.com/lists/oss-security/2019/07/08/3 · Mailing List
access.redhat.com/errata/RHSA-2019:3387 · Third Party Advisory
gitlab.com/libosinfo/libosinfo/-/tags · Release Notes
gitlab.com/libosinfo/libosinfo/blob/master/NEWS · Release Notes
libosinfo.org/download · Release Notes
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AZU4IPPIR73NYC6E733QR26O5ZI6MMKJ
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEZUZKC6YK4E3NXM7XKZOXY5X5PJSPIR
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4AD73NGYBV7GYT4LFC3TC7AYBWOJTG4
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT44EYZZQFTK7XM6GKCYC4WUE7HYZVXM

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free