CVE-2018-19639
05.03.2019, 16:29
If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as root.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| opensuse | supportutils | 𝑥 < 3.1-5.7.1 |
𝑥
= Vulnerable software versions
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| hostinfo |
| ||||||||||||||||
| supportutils |
|