CVE-2018-20105
yast2-rmt exposes CA private key passhrase in log-file
Reported by microfocus · Published January 27, 2020
A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2. openSUSE Leap yast2-rmt versions prior to 1.2.2.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| yast2-rmt | yast2-rmt_project | 1.2.2 |
| SUSE Linux Enterprise Server 15 | SUSE | 1.2.2 |
| Leap | openSUSE | 1.2.2 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| SUSE | SUSE Linux Enterprise Server 15 | yast2-rmt |
| openSUSE | Leap | yast2-rmt |
| SUSE | SUSE Linux Enterprise Server 15 | * |
| openSUSE | Leap | * |
Timeline
- Mar 18, 2019 CVE Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- Sep 16, 2024 CVE Updated
- Apr 4, 2026 Security Advisory (6 in total, the first dated here)
- Sep 21, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2018-20105
vulnetix vdb fixes CVE-2018-20105Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2018-20105/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- x_refsource_CONFIRM
- openSUSE-SU-2020:0253 vendor-advisoryx_refsource_SUSE
- openSUSE-SU-2020:0320 vendor-advisoryx_refsource_SUSE