CVE-2019-18906
Fixed in a distro release EPSS 1%CVSS 9.8
A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4.
Products: SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Enterprise Storage 6 | cryptctl | 2.4-4.5.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | cryptctl | 2.4-4.5.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | cryptctl | 2.4-4.5.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP2 | cryptctl | 2.4-4.5.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | cryptctl | 2.4-4.5.1 |
| SUSE Linux Enterprise Module for SAP Applications 15 | cryptctl | 2.4-4.5.1 |
| SUSE Linux Enterprise Module for SAP Applications 15 SP1 | cryptctl | 2.4-4.5.1 |
| SUSE Linux Enterprise Server 12 SP5 | cryptctl | 2.4-2.10.1 |
| SUSE Linux Enterprise Server 15 SP1-BCL | cryptctl | 2.4-4.5.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | cryptctl | 2.4-4.5.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | cryptctl | 2.4-2.10.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | cryptctl | 2.4-2.10.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | cryptctl | 2.4-2.10.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | cryptctl | 2.4-4.5.1 |
| SUSE Manager Proxy 4.0 | cryptctl | 2.4-4.5.1 |
| SUSE Manager Retail Branch Server 4.0 | cryptctl | 2.4-4.5.1 |
| SUSE Manager Server 4.0 | cryptctl | 2.4-4.5.1 |
| openSUSE Leap 15.2 | cryptctl | 2.4-lp152.5.3.1 |
| openSUSE Leap 15.3 | cryptctl | 2.4-4.5.1 |
| openSUSE Tumbleweed | cryptctl | 2.4-1.1 |