CVE-2019-18905CWE-345

Deprecated functionality in autoyast2 automatically imports gpg keys without checking them

Medium · published April 3, 2020

CVSS v3.1
4.8
EPSS
1%
Percentile
53.7
In the wild
Unconfirmed
What it is

A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to MITM connections when deprecated and unused functionality of autoyast is used to create images. This issue affects: SUSE Linux Enterprise Server 12 autoyast2 version 4.1.9-3.9.1 and prior versions. SUSE Linux Enterprise Server 15 autoyast2 version 4.0.70-3.20.1 and prior versions.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00730 · 53.7th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2020-04-03T11:00Z
EPSS history
Timeline
  • 03 APR 11:00Z
    Deprecated functionality in autoyast2 automatically imports gpg keys without checking them
    cvelistv5