Vulnerability CVE-2018-17957

Vulnerability Name:

CVE-2018-17957 (CCN-154777)

Assigned:

2018-12-25

Published:

2018-12-25

Updated:

2019-10-09

Summary:

The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing local attackers to access or corrupt the RMT database.

CVSS v3 Severity:

7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

3.4 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N)
3.0 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): High User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

3.2 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:P/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-287

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2018-17957

Source: CCN
Type: Bugzilla Bug 1117602
VUL-1: CVE-2018-17957: yast2-rmt: mysql password exposed in process list

Source: CONFIRM
Type: Exploit, Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1117602

Source: XF
Type: UNKNOWN
suse-cve201817957-info-disc(154777)

Source: CONFIRM
Type: Patch, Third Party Advisory
https://lists.opensuse.org/opensuse-security-announce/2018-12/msg00068.html

Source: CCN
Type: SUSE Web site
CVE-2018-17957

Vulnerable Configuration:

Configuration 1:

cpe:/a:suse:repository_mirroring_tool:*:*:*:*:*:*:*:* (Version < 1.1.2)

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:636	P	Security update for nodejs16 (Important) (in QA)	2022-09-29
oval:org.opensuse.security:def:201817957	V	CVE-2018-17957	2022-09-02
oval:org.opensuse.security:def:94254	P	(Moderate)	2022-07-06
oval:org.opensuse.security:def:3536	P	kbd-2.0.4-8.10.2 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:95166	P	yast2-rmt-1.3.2-3.3.1 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:1080	P	Security update for ImageMagick (Moderate) (in QA)	2022-06-16
oval:org.opensuse.security:def:1667	P	Security update for rsyslog (Important)	2022-05-09
oval:org.opensuse.security:def:113618	P	yast2-rmt-1.3.3-1.2 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:1602	P	Security update for the Linux Kernel (Important)	2022-01-14
oval:org.opensuse.security:def:107000	P	yast2-rmt-1.3.3-1.2 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:51670	P	Security update for python-urllib3 (Moderate)	2021-09-29
oval:org.opensuse.security:def:71342	P	libzmq5-4.2.3-3.3.2 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:90082	P	yast2-rmt-1.2.1-1.25 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:63247	P	yast2-rmt-1.2.1-1.25 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:2158	P	yast2-rmt-1.2.1-1.25 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:97047	P	yast2-rmt-1.2.1-1.25 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:103737	P	yast2-rmt-1.2.1-1.25 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:64755	P	Security update for spectre-meltdown-checker (Moderate)	2021-08-27
oval:org.opensuse.security:def:70279	P	Security update for djvulibre (Important)	2021-08-20
oval:org.opensuse.security:def:47930	P	yast2-3.2.48-3.29.20 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47737	P	libltdl7-2.4.2-17.4.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47616	P	gdk-pixbuf-loader-rsvg-2.40.20-5.6.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47602	P	elfutils-0.158-6.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48302	P	sane-backends-1.0.24-3.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48154	P	libncurses5-32bit-5.9-64.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48062	P	lftp-4.7.4-3.6.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47601	P	ecryptfs-utils-103-8.3.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:2297	P	yast2-rmt-1.3.2-3.3.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:101412	P	yast2-rmt-1.3.2-3.3.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:63386	P	yast2-rmt-1.3.2-3.3.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:100967	P	librrd8-1.7.0-4.34 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:68002	P	Security update for the Linux Kernel (Live Patch 18 for SLE 15 SP1) (Important)	2021-06-18
oval:org.opensuse.security:def:66831	P	Security update for java-1_8_0-openjdk (Moderate)	2021-06-17
oval:org.opensuse.security:def:51585	P	Security update for caribou (Important)	2021-06-10
oval:org.opensuse.security:def:48662	P	argyllcms-1.6.3-1.179 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48600	P	perl-YAML-LibYAML-0.38-10.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48516	P	libldap-2_4-2-2.4.41-18.25.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48829	P	drm-kmp-default-4.9.33_k4.4.73_5-2.4 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48758	P	telepathy-gabble-0.18.1-3.268 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48727	P	java-1_7_0-openjdk-plugin-1.6.1-2.3.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:73614	P	Security update for java-11-openjdk (Important)	2021-05-11
oval:org.opensuse.security:def:64668	P	Security update for s390-tools (Important)	2021-03-12
oval:org.opensuse.security:def:51742	P	Security update for openldap2 (Important)	2021-03-03
oval:org.opensuse.security:def:68102	P	Security update for the Linux Kernel (Important)	2021-02-19
oval:org.opensuse.security:def:66923	P	Security update for openvswitch (Important)	2021-02-03
oval:org.opensuse.security:def:4069	P	Security update for MozillaFirefox (Important)	2021-01-29
oval:org.opensuse.security:def:70174	P	Security update for xen (Moderate)	2020-12-22
oval:org.opensuse.security:def:51484	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:4052	P	Security update for MozillaFirefox (Critical)	2020-12-21
oval:org.opensuse.security:def:3885	P	finch-devel-2.12.0-3.3.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:107633	P	yast2-rmt-1.3.0-1.43 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:3996	P	libjavascriptcoregtk-1_0-0-2.4.11-23.20 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:4106	P	openldap2-back-perl-2.4.41-18.63.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:3980	P	libgit2-24-0.24.1-7.9.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:117191	P	yast2-rmt-1.3.0-1.43 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:4102	P	obs-service-set_version-0.5.11-1.3.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:71455	P	chrony-3.2-9.12.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:3968	P	libcroco-0.6.11-12.3.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63312	P	yast2-rmt-1.3.0-1.43 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:3877	P	dovecot22-devel-2.2.31-19.17.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:4099	P	net-snmp-devel-5.7.3-6.6.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:3937	P	libXext-devel-1.3.2-4.3.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:2223	P	yast2-rmt-1.3.0-1.43 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:4092	P	mozilla-nspr-devel-4.21-19.9.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:3897	P	gdk-pixbuf-devel-2.34.0-19.17.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:4765	P	Security update for yast2-rmt (Important)	2020-12-02
oval:org.opensuse.security:def:4744	P	Security update for rsyslog (Moderate)	2020-12-02
oval:org.opensuse.security:def:51851	P	Security update for python-setuptools (Important)	2020-12-02
oval:org.opensuse.security:def:51050	P	Security update for slirp4netns (Important)	2020-12-01
oval:org.opensuse.security:def:51776	P	Security update for opencv (Moderate)	2020-12-01
oval:org.opensuse.security:def:50946	P	Security update for xen (Important)	2020-12-01
oval:org.opensuse.security:def:53127	P	Security update for samba (Important)	2020-12-01
oval:org.opensuse.security:def:50394	P	Security update for systemd (Important)	2020-12-01
oval:org.opensuse.security:def:50783	P	Security update for grub2 (Important)	2020-12-01
oval:org.opensuse.security:def:50043	P	yast2-rmt on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50550	P	Security update for sqlite3 (Moderate)	2020-12-01
oval:org.opensuse.security:def:73496	P	cvs on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49989	P	apache2-mod_apparmor on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50417	P	Security update for zeromq (Important)	2020-12-01
oval:org.opensuse.security:def:50108	P	yast2-rmt on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50395	P	Security update for libtasn1 (Moderate)	2020-12-01
oval:org.opensuse.security:def:51214	P	Security update for bluez (Moderate)	2020-12-01
oval:org.opensuse.security:def:50054	P	dhcp-relay on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:53196	P	Security update for yast2-rmt (Important)	2020-12-01

BACK