CVE-2019-18905
Medium
Description
A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to MITM connections when deprecated and unused functionality of autoyast is used to create images. This issue affects: SUSE Linux Enterprise Server 12 autoyast2 version 4.1.9-3.9.1 and prior versions. SUSE Linux Enterprise Server 15 autoyast2 version 4.0.70-3.20.1 and prior versions.
SeverityMedium
CVSS4.8
Exploit probability54. percentile0.7%
ProductOpensuse Autoyast2
PublishedApr 3, 2020
First seenApr 3, 2020
Weakness typeCWE-345CWE-345
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opensuse autoyast2 | v ≤ 4.1.9-3.9.1, v ≤ 4.0.70-3.20.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.