CVE-2016-4989
setroubleshoot allows local users to bypass an intended container protection mechanism and...
CVE-2016-4989 is a high vulnerability (CVSS 7.0) in Setroubleshoot Project Setroubleshoot, published April 11, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. No source names a fixed version.
- Severity
- 7.0 HighCVSS 3.0, NVD
- Exploit chance
- 0.46%EPSS, 40th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with a crafted file name, which is handled by the _set_tpath function in audit_data.py or via a crafted (2) local_id or (3) analysis_id field in a crafted XML document to the run_fix function in SetroubleshootFixit.py, related to the subprocess.check_output and commands.getstatusoutput functions, a different vulnerability than CVE-2016-4445.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
setroubleshootRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs | before 0:3.0.47-12.el6_8 | 0:3.0.47-12.el6_8 |
setroubleshoot-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs | before 0:3.0.47-12.el6_8 | 0:3.0.47-12.el6_8 |
setroubleshoot-pluginsRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs | before 0:3.0.40-3.1.el6_8 | 0:3.0.40-3.1.el6_8 |
setroubleshoot-serverRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs | before 0:3.0.47-12.el6_8 | 0:3.0.47-12.el6_8 |
setroubleshoot-docRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs | before 0:3.0.47-12.el6_8 | 0:3.0.47-12.el6_8 |
setroubleshootRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs | before 0:3.0.47-12.el6_8 | 0:3.0.47-12.el6_8 |
setroubleshoot-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs | before 0:3.0.47-12.el6_8 | 0:3.0.47-12.el6_8 |
setroubleshoot-pluginsRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs | before 0:3.0.40-3.1.el6_8 | 0:3.0.40-3.1.el6_8 |
setroubleshoot-serverRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs | before 0:3.0.47-12.el6_8 | 0:3.0.47-12.el6_8 |
setroubleshoot-docRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs | before 0:3.0.47-12.el6_8 | 0:3.0.47-12.el6_8 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
setroubleshootRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs | before 0:3.0.47-12.el6_8 | 0:3.0.47-12.el6_8 |
setroubleshoot-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs | before 0:3.0.47-12.el6_8 | 0:3.0.47-12.el6_8 |
setroubleshoot-pluginsRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs | before 0:3.0.40-3.1.el6_8 | 0:3.0.40-3.1.el6_8 |
setroubleshoot-serverRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs | before 0:3.0.47-12.el6_8 | 0:3.0.47-12.el6_8 |
setroubleshoot-docRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs | before 0:3.0.47-12.el6_8 | 0:3.0.47-12.el6_8 |
setroubleshootRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs | before 0:3.2.24-4.el7_2 | 0:3.2.24-4.el7_2 |
setroubleshoot-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs | before 0:3.2.24-4.el7_2 | 0:3.2.24-4.el7_2 |
setroubleshoot-pluginsRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs | before 0:3.0.59-2.el7_2 | 0:3.0.59-2.el7_2 |
setroubleshoot-serverRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs | before 0:3.2.24-4.el7_2 | 0:3.2.24-4.el7_2 |
setroubleshootRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs | before 0:3.2.24-4.el7_2 | 0:3.2.24-4.el7_2 |
setroubleshoot-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs | before 0:3.2.24-4.el7_2 | 0:3.2.24-4.el7_2 |
setroubleshoot-pluginsRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs | before 0:3.0.59-2.el7_2 | 0:3.0.59-2.el7_2 |
setroubleshoot-serverRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs | before 0:3.2.24-4.el7_2 | 0:3.2.24-4.el7_2 |
setroubleshootRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs | before 0:3.2.24-4.el7_2 | 0:3.2.24-4.el7_2 |
setroubleshoot-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs | before 0:3.2.24-4.el7_2 | 0:3.2.24-4.el7_2 |
setroubleshoot-pluginsRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs | before 0:3.0.59-2.el7_2 | 0:3.0.59-2.el7_2 |
setroubleshoot-serverRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs | before 0:3.2.24-4.el7_2 | 0:3.2.24-4.el7_2 |
What each source reports
NVD Score used
setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with a crafted file name, which is handled by the _set_tpath function in audit_data.py or via a crafted (2) local_id or (3) analysis_id field in a crafted XML document to the run_fix function in SetroubleshootFixit.py, related to the subprocess.check_output and commands.getstatusoutput functions, a different vulnerability than CVE-2016-4445.
- Record
CVE-2016-4989- CVSS 3.0
- 7.0 High
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE ListNo score
setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with a crafted file name, which is handled by the _set_tpath function in audit_data.py or via a crafted (2) local_id or (3) analysis_id field in a crafted XML document to the run_fix function in SetroubleshootFixit.py, related to the subprocess.check_output and commands.getstatusoutput functions, a different vulnerability than CVE-2016-4445.
- Record
CVE-2016-4989- Updated
- 2026-11-02
EUVDEUVD-2016-5955No score
setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with a crafted file name, which is handled by the _set_tpath function in audit_data.py or via a crafted (2) local_id or (3) analysis_id field in a crafted XML document to the run_fix function in SetroubleshootFixit.py, related to the subprocess.check_output and commands.getstatusoutput functions, a different vulnerability than CVE-2016-4445.
- Record
EUVD-2016-5955- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-585r-x79p-835g
setroubleshoot allows local users to bypass an intended container protection mechanism and...
setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with a crafted file name, which is handled by the _set_tpath function in audit_data.py or via a crafted (2) local_id or (3) analysis_id field in a crafted XML document to the run_fix function in SetroubleshootFixit.py, related to the subprocess.check_output and commands.getstatusoutput functions, a different vulnerability than CVE-2016-4445.
- Record
GHSA-585r-x79p-835g- CVSS 3.0
- 7.0 High
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
OSV
setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with a crafted file name, which is handled by the _set_tpath function in audit_data.py or via a crafted (2) local_id or (3) analysis_id field in a crafted XML document to the run_fix function in SetroubleshootFixit.py, related to the subprocess.check_output and commands.getstatusoutput functions, a different vulnerability than CVE-2016-4445.
- Record
CVE-2016-4989- CVSS 3.0
- 7.0 High
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
bugzilla.redhat.com/show_bug.cgi?id=1346461
rhn.redhat.com/errata/RHSA-2016-1267.html
github.com/fedora-selinux/setroubleshoot/commit/e69378d7e82a503534d29c5939fa219341e8f2ad
seclists.org/oss-sec/2016/q2/574
access.redhat.com/errata/RHSA-2016:1293
securitytracker.com/id/1036144
Show 21 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-4989
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1267.json
cve.org/CVERecord?id=CVE-2016-4444