CVE-2018-19639 Code execution if run with command line switch -v
HighCVSS 7.8
EPSS 0.50%
- Published
- Updated
- Exploit status
- No public exploit known
Description
If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as root.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openSUSE supportutils | < 3.1-5.7.1 | 3.1-5.7.1 |
| SUSE supportutils | < 3.1-5.7.1 | 3.1-5.7.1 |
References
- openSUSE-SU-2019:1351 vendor-advisory
- bugzilla.suse.com