Opensuse Supportutils vulnerabilities

6 CVEs affecting Opensuse Supportutils, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-45154, published 2023-02-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-19639, published 2019-03-05. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands…
CVE-2018-19637, published 2019-03-05. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protection
CVE-2018-19638, published 2019-03-05. Medium severity, CVSS 4.7. EPSS: 0.4% chance of exploitation in the next 30 days. In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to…
CVE-2018-19636, published 2019-03-05. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with…
CVE-2018-19640, published 2019-03-05. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. If the attacker manages to create files in the directory used to collect log files in supportutils before version 3.1-5.7.1 (e.g. with CVE-2018-19638) he can kill arbitrary processes on the local…
CVE-2022-45154, published 2023-02-15. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers…