Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2019-18906

cryptctl: client side password hashing is equivalent to clear text password storage

Description

A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE SUSE Linux Enterprise Server for SAP 12-SP5

  • cryptctl to < 2.4affected

SUSE SUSE Manager Server 4.0

  • cryptctl to < 2.4affected

References