CVE-2019-18905

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise Server 12 autoyast2 versions 4.1.9-3.9.1 and prior versions SUSE Linux Enterprise Server 15 autoyast2 versions 4.0.70-3.20.1 and prior versions

Description A vulnerability in autoyast2 of SUSE Linux Enterprise Server 12 and SUSE Linux Enterprise Server 15 allows remote attackers to perform man-in-the-middle (MITM) connections when deprecated and unused functionality of autoyast is used to create images.

Recommendations For SUSE Linux Enterprise Server 12 autoyast2 versions 4.1.9-3.9.1 and prior versions, update to a version later than 4.1.9-3.9.1 to resolve the issue. For SUSE Linux Enterprise Server 15 autoyast2 versions 4.0.70-3.20.1 and prior versions, update to a version later than 4.0.70-3.20.1 to resolve the issue. As a temporary workaround, consider disabling the deprecated and unused functionality of autoyast to minimize the risk of exploitation.