CVE-2019-3700
CVSS V2 Low 2.1
CVSS V3 Low 3.3
Description
yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were moved to a different location. As of the 20191022 snapshot the insecure default settings were used until yast2-security switched to stronger defaults in 4.2.6 and used the new configuration file locations. Password created during this time used DES password encryption and are not properly protected against attackers that are able to access the password hashes.
Overview
- CVE ID
- CVE-2019-3700
- Assigner
- meissner@suse.de
- Vulnerability Status
- Analyzed
- Published Version
- 2020-01-24T14:15:11
- Last Modified Date
- 2020-02-05T15:16:56
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:suse:yast2-security:*:*:*:*:*:*:*:* | 1 | OR | 4.2.6 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:L/AC:L/Au:N/C:P/I:N/A:N
- Access Vector
- LOCAL
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- NONE
- Availability Impact
- NONE
- Base Score
- 2.1
- Severity
- LOW
- Exploitability Score
- 3.9
- Impact Score
- 2.9
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Attack Vector
- LOCAL
- Attack Compatibility
- LOW
- Privileges Required
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- LOW
- Availability Impact
- NONE
- Base Score
- 3.3
- Base Severity
- LOW
- Exploitability Score
- 1.8
- Impact Score
- 1.4
References
| Reference URL | Reference Tags |
|---|---|
| https://bugzilla.suse.com/show_bug.cgi?id=1157541 | Issue Tracking Vendor Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2019-3700 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3700 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 16:51:03 | Added to TrackCVE | |||
| 2022-12-04 10:02:46 | security@suse.com | meissner@suse.de | CVE Assigner | updated |
| 2022-12-04 10:02:46 | 2020-01-24T14:15Z | 2020-01-24T14:15:11 | CVE Published Date | updated |
| 2022-12-04 10:02:46 | 2020-02-05T15:16:56 | CVE Modified Date | updated | |
| 2022-12-04 10:02:46 | Analyzed | Vulnerability Status | updated |