CVE-2018-19639

If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as root.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.7 MEDIUM
LOCAL
HIGH
LOW
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 40%
Affected Products (NVD)
VendorProductVersion
opensusesupportutils
𝑥
< 3.1-5.7.1
𝑥
= Vulnerable software versions
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
hostinfo
suse enterprise sap 12 SP2
1.0.1-19.5.1
fixed
suse enterprise sap 12 SP3
1.0.1-19.5.1
fixed
suse enterprise sap 12 SP4
1.0.1-19.5.1
fixed
suse enterprise server 12
1.0.1-19.5.1
fixed
suse enterprise server 12 SP1
1.0.1-19.5.1
fixed
suse enterprise server 12 SP2
1.0.1-19.5.1
fixed
suse enterprise server 12 SP3
1.0.1-19.5.1
fixed
suse enterprise server 12 SP4
1.0.1-19.5.1
fixed
supportutils
suse enterprise sap 12 SP2
3.0-95.21.1
fixed
suse enterprise sap 12 SP3
3.0-95.21.1
fixed
suse enterprise sap 12 SP4
3.0-95.21.1
fixed
suse enterprise server 12
3.0-95.21.1
fixed
suse enterprise server 12 SP1
3.0-95.21.1
fixed
suse enterprise server 12 SP2
3.0-95.21.1
fixed
suse enterprise server 12 SP3
3.0-95.21.1
fixed
suse enterprise server 12 SP4
3.0-95.21.1
fixed