openSUSE cryptctl vulnerabilities

Latest openSUSE cryptctl CVEs

Newest publication first

1. CVE-2019-18906 cryptctl: client side password hashing is equivalent to clear text password storage

   Published 2021-06-30

   Critical·CVSS 9.8

   A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cr...

2. CVE-2017-9270 post-auth arbitrary file write on cryptctl server

   Published 2018-03-01

   Critical·CVSS 9.1

   In cryptctl before version 2.0 a malicious server could send RPC requests that could overwrite files outside of the cryptctl key database.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.