Read the docs
TI-2019-13628 Aliases CVE-2019-18904GHSA-fpvp-5qrg-qr4v

Migrations requests can cause DoS on rmt

Priority LOW 36CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.

Summary

A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux Enterprise Module for Server Applications 15-SP1, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1 allows remote attackers to cause DoS against rmt by requesting migrations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Public Cloud 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Module for Server Applications 15 rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Server Applications 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Server 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.5.2-3.26.1. openSUSE Leap 15.1 rmt-server versions prior to 2.5.2-lp151.2.9.1.

Why it matters now

EPSS 0.01585 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed SUSE Linux Enterprise High Performance Computing 15-ESPOS (SUSE): 2.5.2-3.26.1SUSE Linux Enterprise High Performance Computing 15-LTSS (SUSE): 2.5.2-3.26.1+6 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSESUSE Linux Enterprise High Performance Computing 15-ESPOSrmt-server to before 2.5.2-3.26.12.5.2-3.26.1Patch availableCNA
SUSESUSE Linux Enterprise High Performance Computing 15-LTSSrmt-server to before 2.5.2-3.26.12.5.2-3.26.1Patch availableCNA
SUSESUSE Linux Enterprise Module for Public Cloud 15-SP1rmt-server to before 2.5.2-3.9.12.5.2-3.9.1Patch availableCNA
SUSESUSE Linux Enterprise Module for Server Applications 15rmt-server to before 2.5.2-3.26.12.5.2-3.26.1Patch availableCNA
SUSESUSE Linux Enterprise Module for Server Applications 15-SP1rmt-server to before 2.5.2-3.9.12.5.2-3.9.1Patch availableCNA
SUSESUSE Linux Enterprise Server 15-LTSSrmt-server to before 2.5.2-3.26.12.5.2-3.26.1Patch availableCNA
SUSESUSE Linux Enterprise Server for SAP 15rmt-server to before 2.5.2-3.26.12.5.2-3.26.1Patch availableCNA
openSUSEopenSUSE Leap 15.1rmt-server to before 2.5.2-lp151.2.9.12.5.2-lp151.2.9.1Patch availableCNA
  • SUSE Linux Enterprise High Performance Computing 15-ESPOS VendorSUSE Affected rmt-server to before 2.5.2-3.26.1 Fixed in 2.5.2-3.26.1 Patch available CNA
  • SUSE Linux Enterprise High Performance Computing 15-LTSS VendorSUSE Affected rmt-server to before 2.5.2-3.26.1 Fixed in 2.5.2-3.26.1 Patch available CNA
  • SUSE Linux Enterprise Module for Public Cloud 15-SP1 VendorSUSE Affected rmt-server to before 2.5.2-3.9.1 Fixed in 2.5.2-3.9.1 Patch available CNA
  • SUSE Linux Enterprise Module for Server Applications 15 VendorSUSE Affected rmt-server to before 2.5.2-3.26.1 Fixed in 2.5.2-3.26.1 Patch available CNA
  • SUSE Linux Enterprise Module for Server Applications 15-SP1 VendorSUSE Affected rmt-server to before 2.5.2-3.9.1 Fixed in 2.5.2-3.9.1 Patch available CNA
  • SUSE Linux Enterprise Server 15-LTSS VendorSUSE Affected rmt-server to before 2.5.2-3.26.1 Fixed in 2.5.2-3.26.1 Patch available CNA
  • SUSE Linux Enterprise Server for SAP 15 VendorSUSE Affected rmt-server to before 2.5.2-3.26.1 Fixed in 2.5.2-3.26.1 Patch available CNA
  • openSUSE Leap 15.1 VendoropenSUSE Affected rmt-server to before 2.5.2-lp151.2.9.1 Fixed in 2.5.2-lp151.2.9.1 Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:opensuse:rmt-server:*:*:*:*:*:*:*:*up to 2.5.2-3.26.1VulnerableopenSUSE
cpe:2.3:a:suse:linux_enterprise_high_performance_computing:15.0:*:*:*:espos:*:*:*15.0Running onSUSE
cpe:2.3:a:suse:linux_enterprise_high_performance_computing:15.0:*:*:*:ltss:*:*:*15.0Running onSUSE
cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:-:*:*15Running onSUSE
cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:ltss:*:*15Running onSUSE
cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:sap:*:*15Running onSUSE
cpe:2.3:a:opensuse:rmt-server:*:*:*:*:*:*:*:*up to 2.5.2-3.9.1VulnerableopenSUSE
cpe:2.3:o:suse:linux_enterprise:15.0:sp1:*:*:*:public_cloud:*:*15.0 sp1Running onSUSE
cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:*:*:*:*15 sp1Running onSUSE
cpe:2.3:a:opensuse:rmt-server:*:*:*:*:*:*:*:*up to 2.5.2-lp151.2.9.1VulnerableopenSUSE
  • cpe:2.3:a:opensuse:rmt-server:*:*:*:*:*:*:*:* Versions up to 2.5.2-3.26.1 Vulnerable ·openSUSE
  • cpe:2.3:a:suse:linux_enterprise_high_performance_computing:15.0:*:*:*:espos:*:*:* Versions 15.0 Running on ·SUSE
  • cpe:2.3:a:suse:linux_enterprise_high_performance_computing:15.0:*:*:*:ltss:*:*:* Versions 15.0 Running on ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:-:*:* Versions 15 Running on ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:ltss:*:* Versions 15 Running on ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:sap:*:* Versions 15 Running on ·SUSE
  • cpe:2.3:a:opensuse:rmt-server:*:*:*:*:*:*:*:* Versions up to 2.5.2-3.9.1 Vulnerable ·openSUSE
  • cpe:2.3:o:suse:linux_enterprise:15.0:sp1:*:*:*:public_cloud:*:* Versions 15.0 sp1 Running on ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:*:*:*:* Versions 15 sp1 Running on ·SUSE
  • cpe:2.3:a:opensuse:rmt-server:*:*:*:*:*:*:*:* Versions up to 2.5.2-lp151.2.9.1 Vulnerable ·openSUSE
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1Running onopenSUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Running on ·openSUSE

Remediation

  • Fix · CNA SUSE Linux Enterprise High Performance Computing 15-ESPOS (SUSE) Fixed in 2.5.2-3.26.1
  • Fix · CNA SUSE Linux Enterprise High Performance Computing 15-LTSS (SUSE) Fixed in 2.5.2-3.26.1
  • Fix · CNA SUSE Linux Enterprise Module for Public Cloud 15-SP1 (SUSE) Fixed in 2.5.2-3.9.1
  • Fix · CNA SUSE Linux Enterprise Module for Server Applications 15 (SUSE) Fixed in 2.5.2-3.26.1
  • Fix · CNA SUSE Linux Enterprise Module for Server Applications 15-SP1 (SUSE) Fixed in 2.5.2-3.9.1
  • Fix · CNA SUSE Linux Enterprise Server 15-LTSS (SUSE) Fixed in 2.5.2-3.26.1
  • Fix · CNA SUSE Linux Enterprise Server for SAP 15 (SUSE) Fixed in 2.5.2-3.26.1
  • Fix · CNA openSUSE Leap 15.1 (openSUSE) Fixed in 2.5.2-lp151.2.9.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-18904
  2. 2026-10-03 Alias added: GHSA-fpvp-5qrg-qr4v

References

Exploit 1

  • TI-2016-03560 Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-03506 Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04302 Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04301 Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04298 Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
See all 1331 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences