Lucene search

SuseCVE-2019-18905

HistoryApr 03, 2020 - 11:15 a.m.

CVE-2019-18905

2020-04-0311:15:12

CWE-345

suse

web.nvd.nist.gov

139

cve-2019-18905

insufficient verification

data authenticity

vulnerability

suse linux enterprise server

mitm

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

48.2%

JSON

A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to MITM connections when deprecated and unused functionality of autoyast is used to create images. This issue affects: SUSE Linux Enterprise Server 12 autoyast2 version 4.1.9-3.9.1 and prior versions. SUSE Linux Enterprise Server 15 autoyast2 version 4.0.70-3.20.1 and prior versions.

Affected configurations

Nvd

Node

suselinux_enterprise_serverMatch12-

AND

opensuseautoyast2Range≤4.1.9-3.9.1

Node

suselinux_enterprise_serverMatch15

AND

opensuseautoyast2Range≤4.0.70-3.20.1

VendorProductVersionCPE
suselinux_enterprise_server12cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*
opensuseautoyast2*cpe:2.3:a:opensuse:autoyast2:*:*:*:*:*:*:*:*
suselinux_enterprise_server15cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
suse	linux_enterprise_server	12	cpe:2.3:o:suse:linux_enterprise_server:12:-::::::
opensuse	autoyast2	*	cpe:2.3:a:opensuse:autoyast2::::::::
suse	linux_enterprise_server	15	cpe:2.3:o:suse:linux_enterprise_server:15:::::::*

CNA Affected

[
  {
    "product": "SUSE Linux Enterprise Server 12",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThanOrEqual": "4.1.9-3.9.1",
        "status": "affected",
        "version": "autoyast2",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "SUSE Linux Enterprise Server 15",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThanOrEqual": "4.0.70-3.20.1",
        "status": "affected",
        "version": "autoyast2",
        "versionType": "custom"
      }
    ]
  }
]

References

lists.opensuse.org/opensuse-security-announce/2020-05/msg00050.html

bugzilla.suse.com/show_bug.cgi?id=1140711

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

48.2%

JSON

Related for CVE-2019-18905