Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2019-18905
Modified
More InfoOfficial Page
Source-meissner@suse.de
View Known Exploited Vulnerability (KEV) details
Published At-03 Apr, 2020 | 11:15
Updated At-23 May, 2020 | 00:15

A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to MITM connections when deprecated and unused functionality of autoyast is used to create images. This issue affects: SUSE Linux Enterprise Server 12 autoyast2 version 4.1.9-3.9.1 and prior versions. SUSE Linux Enterprise Server 15 autoyast2 version 4.0.70-3.20.1 and prior versions.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.15.9MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Secondary3.14.8MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Primary2.04.3MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Type: Primary
Version: 3.1
Base score: 5.9
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Type: Secondary
Version: 3.1
Base score: 4.8
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Type: Primary
Version: 2.0
Base score: 4.3
Base severity: MEDIUM
Vector:
AV:N/AC:M/Au:N/C:N/I:P/A:N
CPE Matches
SUSE
suse
>>linux_enterprise_server>>12
cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*
openSUSE
opensuse
>>autoyast2>>Versions up to 4.1.9-3.9.1(inclusive)
cpe:2.3:a:opensuse:autoyast2:*:*:*:*:*:*:*:*
SUSE
suse
>>linux_enterprise_server>>15
cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:*:*:*
openSUSE
opensuse
>>autoyast2>>Versions up to 4.0.70-3.20.1(inclusive)
cpe:2.3:a:opensuse:autoyast2:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-345Primarynvd@nist.gov
CWE-345Secondarymeissner@suse.de
CWE ID: CWE-345
Type: Primary
Source: nvd@nist.gov
CWE ID: CWE-345
Type: Secondary
Source: meissner@suse.de
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00050.htmlmeissner@suse.de
N/A
https://bugzilla.suse.com/show_bug.cgi?id=1140711meissner@suse.de
Issue Tracking
Vendor Advisory
Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00050.html
Source: meissner@suse.de
Resource: N/A
Hyperlink: https://bugzilla.suse.com/show_bug.cgi?id=1140711
Source: meissner@suse.de
Resource:
Issue Tracking
Vendor Advisory
Change History
0Changes found
Details not found