CVE-2018-17957

yast2-rmt leaks database passwords in process list

State: Published
Severity: 3.4 Low
Published: Dec 26, 2018
Updated: Sep 16, 2024
Reserved: Oct 3, 2018

Description

The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing local attackers to access or corrupt the RMT database.

Scores

CVSS	Score	Vector	Source
3.0	3.4 Low	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N	microfocus

Weaknesses

CWE-214

Affected Products

Product	Versions
yast2-rmtSUSE	before 1.1.2Affected

References

https://lists.opensuse.org/opensuse-security-announce/2018-12/msg00068.html
https://bugzilla.suse.com/show_bug.cgi?id=1117602

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.