Skip to content
fr Sign in
2.9 Low

CVE-2019-3700 yast2-security didn't use secure defaults to protect passwords

Description

yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were moved to a different location. As of the 20191022 snapshot the insecure default settings were used until yast2-security switched to stronger defaults in 4.2.6 and used the new configuration file locations. Password created during this time used DES password encryption and are not properly protected against attackers that are able to access the password hashes.

Affected products and versions

Product Affected versions Fixed in
Factory 4.2 earliest → < 4.2.6 4.2.6

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Factory

The 24 CVEs of Factory →
CVE-2022-31253 A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap… 7.1 High CVE-2022-21946 A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of… 5.3 Medium CVE-2022-21945 A Insecure Temporary File vulnerability in cscreen of openSUSE Factory allows local attackers to cause DoS for cscreen… 5.1 Medium CVE-2022-21944 A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports… 7.8 High
Track this CVE