Vulnerability Name:

CVE-2019-3700 (CCN-175387)

Assigned:2019-11-27
Published:2019-11-27
Updated:2020-02-05
Summary:yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were moved to a different location. As of the 20191022 snapshot the insecure default settings were used until yast2-security switched to stronger defaults in 4.2.6 and used the new configuration file locations. Password created during this time used DES password encryption and are not properly protected against attackers that are able to access the password hashes.
CVSS v3 Severity:3.3 Low (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
2.9 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
9.1 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
7.9 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
9.4 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-327
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2019-3700

Source: CCN
Type: Bug 1157541
(CVE-2019-3700) VUL-0: CVE-2019-3700: yast: Fallback to DES without configuration in /etc/login.def

Source: CONFIRM
Type: Issue Tracking, Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1157541

Source: XF
Type: UNKNOWN
opensuse-cve20193700-weak-security(175387)

Source: CCN
Type: openSUSE Web site
yast2-security

Vulnerable Configuration:Configuration 1:
  • cpe:/a:suse:yast2-security:*:*:*:*:*:*:*:* (Version < 4.2.6)

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20193700
    V
    		CVE-2019-3700
    2023-06-22
    oval:org.opensuse.security:def:7840
    P
    		yast2-security-4.5.6-150500.1.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:3234
    P
    		libpng15-15-1.5.22-9.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:94864
    P
    		yast2-security-4.4.13-150400.1.7 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:343
    P
    		yast2-security-4.3.16-1.1 on GA media (Moderate)
    2022-06-13
    oval:org.opensuse.security:def:395
    P
    		yast2-security-4.4.13-150400.1.7 on GA media (Moderate)
    2022-06-10
    oval:org.opensuse.security:def:924
    P
    		Security update for dpkg (Low) (in QA)
    2022-05-27
    oval:org.opensuse.security:def:113620
    P
    		yast2-security-4.4.1-1.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:70016
    P
    		Security update for busybox (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:100693
    P
    		 (Moderate)
    2021-12-07
    oval:org.opensuse.security:def:93980
    P
    		 (Important)
    2021-10-25
    oval:org.opensuse.security:def:1272
    P
    		Security update for the Linux Kernel (Live Patch 2 for SLE 15 SP3) (Important)
    2021-10-12
    oval:org.opensuse.security:def:107002
    P
    		yast2-security-4.4.1-1.2 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:69911
    P
    		Security update for openexr (Important)
    2021-08-20
    oval:org.opensuse.security:def:72102
    P
    		yast2-security-4.3.16-1.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:101119
    P
    		yast2-security-4.3.16-1.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62361
    P
    		yast2-security-4.3.16-1.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:71754
    P
    		yast2-security-4.2.12-1.27 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:107359
    P
    		yast2-security-4.2.12-1.27 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62013
    P
    		yast2-security-4.2.12-1.27 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:116917
    P
    		yast2-security-4.2.12-1.27 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:49365
    P
    		yast2-security on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:73233
    P
    		libtspi1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:66568
    P
    		log4j12 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:66660
    P
    		yast2-security on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:73351
    P
    		yast2-security on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49311
    P
    		python3-Werkzeug on GA media (Moderate)
    2020-12-01
    BACK
    suse yast2-security *