TI-2019-02722 Aliases CVE-2019-3700 GHSA-6ff8-jh7v-68j7

yast: Fallback to DES without configuration in /etc/login.def

LOW 15CWE-327Published 2020-01-24 · Updated 2024-09-17

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-327.

Summary

yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were moved to a different location. As of the 20191022 snapshot the insecure default settings were used until yast2-security switched to stronger defaults in 4.2.6 and used the new configuration file locations. Password created during this time used DES password encryption and are not properly protected against attackers that are able to access the password hashes.

Why it matters now

EPSS 0.00107 1st percentileScored 2026-11-07

Fix Fixed Factory (openSUSE): 4.2.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
openSUSE	Factory	yast2-security to before 4.2.6	4.2.6	Patch available	CNA

Factory VendoropenSUSE Affected yast2-security to before 4.2.6 Fixed in 4.2.6 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:suse:yast2-security::::::::	before 4.2.6	Vulnerable	SUSE

cpe:2.3:a:suse:yast2-security:*:*:*:*:*:*:*:* Versions before 4.2.6 Vulnerable ·SUSE

Remediation

Fix · CNA Factory (openSUSE) Fixed in 4.2.6

Timeline

2026-10-02 Threatist record created from CVE-2019-3700
2026-10-03 Alias added: GHSA-6ff8-jh7v-68j7

References

Advisory 1

https://bugzilla.suse.com/show_bug.cgi?id=1157541

TI-2020-12851 An issue was discovered in SaltStack Salt through 3002. KEVCVSS 3.1CRITICAL 9.8
TI-2020-10051 rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
TI-2016-03560 Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote… KEVCVSS 3.1CRITICAL 9.8

See all 3294 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences