Security update for yast2-rmt (moderate)

openSUSE Security Update: Security update for yast2-rmt Announcement ID: openSUSE-SU-2020:0253-1 Rating: moderate References: 1119835 Cross-References: CVE-2018-20105 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for...

CVE-2018-20105

A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2...

CVE-2018-20105

A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2...

CVE-2018-20105

The related OpenSUSE/SUSE entries confirm CVE-2018-20105 affects yast2-rmt and was fixed by updating to yast2-rmt 1.3.0 (openSUSE-2020-320, SUSE-SU-2020:0578-1). The mitigation is to apply this update; the fix addresses an exposure of the CA private key passphrase contained in log files. Summary ...

CVE-2018-20105 yast2-rmt exposes CA private key passhrase in log-file

A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2...

CVE-2019-3700

yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were moved to a different location. As of the 20191022 snapshot the insecure default settings were used until yast2-security switched to stronger...

Default credentials

yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were moved to a different location. As of the 20191022 snapshot the insecure default settings were used until yast2-security switched to stronger...

CVE-2019-3700

The CVE-2019-3700 entry relates to yast2-security not using secure defaults for passwords. Technical details across connected records show insecure defaults used prior to version 4.2.6, with password hashes potentially protected poorly due to DES encryption. The fix stated is that yast2-security ...

openSUSE: Security Advisory for yast2-rmt (openSUSE-SU-2019:1089-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2019:1089-1 Security update for yast2-rmt

This update for yast2-rmt to 1.2.2 fixes the following issues: Security issue fixed: - CVE-2018-20105: Pass SSL password to Cheetah CLI interface securely bsc1119835 Non-security issues fixed: - Launch as root from gnome-shell menu bsc1123562 - Remove broken hyperlink from help bsc1120672 This...

Security update for yast2-rmt (moderate)

openSUSE Security Update: Security update for yast2-rmt Announcement ID: openSUSE-SU-2019:1089-1 Rating: moderate References: 1119835 1120672 1123562 Cross-References: CVE-2018-20105 Affected Products: openSUSE Leap 15.0 An update that solves one vulnerability and has two fixes is now available...

openSUSE Security Update : yast2-rmt (openSUSE-2019-1089)

This update for yast2-rmt to 1.2.2 fixes the following issues : Security issue fixed : - CVE-2018-20105: Pass SSL password to Cheetah CLI interface securely bsc1119835 Non-security issues fixed : - Launch as root from gnome-shell menu bsc1123562 - Remove broken hyperlink from help bsc1120672 This...

openSUSE Security Update : yast2-rmt (openSUSE-2019-1036)

This update for yast2-rmt to version 1.1.12 fixes the following issues : Security issue fixed : - CVE-2018-17957: Secure MySQL credentials by not exposing them on the command line bsc1117602 This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C Tenable Network...

SUSE-SU-2019:0629-1 Security update for yast2-rmt

This update for yast2-rmt to 1.2.2 fixes the following issues: Security issue fixed: - CVE-2018-20105: Pass SSL password to Cheetah CLI interface securely bsc1119835 Non-security issues fixed: - Launch as root from gnome-shell menu bsc1123562 - Remove broken hyperlink from help bsc1120672...

Design/Logic Flaw

In yast2-samba-provision up to and including version 1.0.1 the password for samba shares was provided on the command line to tools used by yast2-samba-provision, allowing local attackers to read them in the process list...

CVE-2018-17955

In yast2-multipath before version 4.1.1 a static temporary filename allows local attackers to overwrite files on systems without symlink protection...

CVE-2018-17956

In yast2-samba-provision up to and including version 1.0.1 the password for samba shares was provided on the command line to tools used by yast2-samba-provision, allowing local attackers to read them in the process list...

CVE-2018-17956

In yast2-samba-provision up to and including version 1.0.1 the password for samba shares was provided on the command line to tools used by yast2-samba-provision, allowing local attackers to read them in the process list...

Code injection

In yast2-printer up to and including version 4.0.2 the SMB printer settings don't escape characters in passwords properly. If a password with backticks or simliar characters is supplied this allows for executing code as root. This requires tricking root to enter such a password in yast...

CVE-2018-20106

In yast2-printer up to and including version 4.0.2 the SMB printer settings don't escape characters in passwords properly. If a password with backticks or simliar characters is supplied this allows for executing code as root. This requires tricking root to enter such a password in yast...