CVE-2019-18905: A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote…

PriorityP431medium5.9CVSS 3.1

AVNACHPRNUINSUCNIHAN

EPSS

0.71%

49.3th percentile

A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to MITM connections when deprecated and unused functionality of autoyast is used to create images. This issue affects: SUSE Linux Enterprise Server 12 autoyast2 version 4.1.9-3.9.1 and prior versions. SUSE Linux Enterprise Server 15 autoyast2 version 4.0.70-3.20.1 and prior versions.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
opensuse	autoyast2	<= 4.1.9-3.9.1	—
opensuse	autoyast2	<= 4.0.70-3.20.1	—
suse	suse_linux_enterprise_server_12	autoyast2 – 4.1.9-3.9.1	—
suse	suse_linux_enterprise_server_15	autoyast2 – 4.0.70-3.20.1	—

CVSS provenance

nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.