CVE-2018-20105CWE-532

yast2-rmt exposes CA private key passhrase in log-file

Medium · published January 27, 2020

CVSS v3.1
4.0
EPSS
0%
Percentile
35.4
In the wild
Unconfirmed
What it is

A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2. openSUSE Leap yast2-rmt versions prior to 1.2.2.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00425 · 35.4th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2020-01-27T08:50Z
EPSS history
Timeline
  • 27 JAN 08:50Z
    yast2-rmt exposes CA private key passhrase in log-file
    cvelistv5