CVE-2018-20105 yast2-rmt exposes CA private key passhrase in log-file
MediumCVSS 5.5
EPSS 0.43%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2. openSUSE Leap yast2-rmt versions prior to 1.2.2.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yast2-rmt project yast2-rmt | < 1.2.2 | 1.2.2 |
| openSUSE leap | = 15.0 | No fix listed |
| suse linux enterprise server | = 15 | No fix listed |
| SUSE Linux Enterprise Server 15 | >= yast2-rmt, < 1.2.2 | 1.2.2 |
| openSUSE leap | >= yast2-rmt, < 1.2.2 | 1.2.2 |
References
- openSUSE-SU-2020:0253 vendor-advisory
- openSUSE-SU-2020:0320 vendor-advisory
- bugzilla.suse.com