An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Packagekit | Packagekit_project | * | 1.1.10 (excluding) |
| Red Hat Enterprise Linux 7 | RedHat | PackageKit-0:1.1.5-2.el7_5 | * |
| Packagekit | Ubuntu | artful | * |
| Packagekit | Ubuntu | devel | * |