CVEvulnerability

CVE-2019-18905

5.9 MEDIUM Published 2020-04-03 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-04-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-345

Description

A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to MITM connections when deprecated and unused functionality of autoyast is used to create images. This issue affects: SUSE Linux Enterprise Server 12 autoyast2 version 4.1.9-3.9.1 and prior versions. SUSE Linux Enterprise Server 15 autoyast2 version 4.0.70-3.20.1 and prior versions.

Affected configurations

• opensuse autoyast2 (<= 4.1.9-3.9.1) • opensuse autoyast2 (<= 4.0.70-3.20.1)

Related

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References