] [day] [month] [year] [list] Date: Thu, 3 Aug 2023 12:08:05 +0200 From: Matthias Gerstner To: [email protected] Subject: Mozilla VPN: CVE-2023-4104: Privileged vpndaemon on Linux wrongly and incompletely implements Polkit authentication Hello list, an openSUSE community packager wanted to add the Mozilla VPN client [1] to openSUSE Tumbleweed, which required a review [2] by the SUSE security team, as it contains a privileged D-Bus service running as root and a Polkit policy.