A vulnerability in GLib's D-Bus client-side DBUS_COOKIE_SHA1 SASL authentication mechanism allows a malicious D-Bus server to provide a cookie_context parameter with path traversal sequences. This improper validation leads to a path traversal attack (CWE-22), enabling the client to read arbitrary files on the filesystem. Successful exploitation requires the attacker to be in a position to perform a man-in-the-middle attack or control a malicious server that the client connects to. Additionally, data exfiltration requires an oracle attack involving guessing and hashing file contents. The vulnerability can lead to disclosure of sensitive information such as SSH keys and API tokens. Red Hat classifies this as a moderate severity issue with a CVSS v3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Red Hat advises connecting only to trusted D-Bus servers, using secure isolated networks, and disabling DBUS_COOKIE_SHA1 authentication to mitigate the risk. Security updates have been released for affected packages in Red Hat Enterprise Linux 8 and related products.

The vulnerability allows an attacker who can perform a man-in-the-middle attack or operate a malicious D-Bus server to cause the client to read arbitrary files via path traversal sequences in the cookie_context parameter. This can lead to exfiltration of sensitive data such as SSH keys and API tokens from the filesystem. The attack complexity is high due to the need for an oracle attack involving guessing and hashing file contents. There is no impact on integrity or availability, but confidentiality is significantly affected.

Red Hat recommends ensuring that applications connect only to trusted D-Bus servers and operate within secure, isolated networks to prevent man-in-the-middle attacks. Additionally, configuring the D-Bus connection to strictly require the EXTERNAL authentication mechanism and disabling DBUS_COOKIE_SHA1 authentication will completely mitigate this vulnerability. Security updates addressing this issue have been released for affected Red Hat Enterprise Linux 8 packages and should be applied promptly. Patch status is confirmed as fixed in updated packages provided by Red Hat.