Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Deprecated functionality in autoyast2 automatically imports gpg keys without checking them (SUSE SUSE Linux Enterprise Server 12)

CVE-2019-18905
MEDIUM 4.8

At a glance

Source
NVD
EPSS
EPSS 0.73 % · percentile 54 ()
State
PUBLISHED
Published
Updated
Assigner
suse
NVD status
Modified

Search on…

Description

A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to MITM connections when deprecated and unused functionality of autoyast is used to create images. This issue affects: SUSE Linux Enterprise Server 12 autoyast2 version 4.1.9-3.9.1 and prior versions. SUSE Linux Enterprise Server 15 autoyast2 version 4.0.70-3.20.1 and prior versions.

Weaknesses (CWE)

  • CWE-345 — Insufficient Verification of Data Authenticity

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Lsuse
CVSS 3.1MEDIUM 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:LNVD · meissner@suse.de (Secondary)
CVSS 3.1MEDIUM 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NNVD · nvd@nist.gov (Primary)
CVSS 2.0MEDIUM 4.3AV:N/AC:M/Au:N/C:N/I:P/A:NNVD · nvd@nist.gov (Primary)

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
SUSE · SUSE Linux Enterprise Server 12affected autoyast2 ≤ 4.1.9-3.9.1
SUSE · SUSE Linux Enterprise Server 15affected autoyast2 ≤ 4.0.70-3.20.1

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD