Deprecated functionality in autoyast2 automatically imports gpg keys without checking them
Priority LOW 28CWE-345Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-345.
Summary
A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to MITM connections when deprecated and unused functionality of autoyast is used to create images. This issue affects: SUSE Linux Enterprise Server 12 autoyast2 version 4.1.9-3.9.1 and prior versions. SUSE Linux Enterprise Server 15 autoyast2 version 4.0.70-3.20.1 and prior versions.
Why it matters now
EPSS 0.0073 54th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SUSE | SUSE Linux Enterprise Server 12 | autoyast2 – 4.1.9-3.9.1 | — | No fix listed | CNA |
| SUSE | SUSE Linux Enterprise Server 15 | autoyast2 – 4.0.70-3.20.1 | — | No fix listed | CNA |
- SUSE Linux Enterprise Server 12 VendorSUSE Affected autoyast2 – 4.1.9-3.9.1 Fixed in — No fix listed CNA
- SUSE Linux Enterprise Server 15 VendorSUSE Affected autoyast2 – 4.0.70-3.20.1 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opensuse:autoyast2:*:*:*:*:*:*:*:* | up to 4.1.9-3.9.1 | Vulnerable | openSUSE |
| cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:* | 12 | Running on | SUSE |
| cpe:2.3:a:opensuse:autoyast2:*:*:*:*:*:*:*:* | up to 4.0.70-3.20.1 | Vulnerable | openSUSE |
| cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:*:*:* | 15 | Running on | SUSE |
- cpe:2.3:a:opensuse:autoyast2:*:*:*:*:*:*:*:* Versions up to 4.1.9-3.9.1 Vulnerable ·openSUSE
- cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:* Versions 12 Running on ·SUSE
- cpe:2.3:a:opensuse:autoyast2:*:*:*:*:*:*:*:* Versions up to 4.0.70-3.20.1 Vulnerable ·openSUSE
- cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:*:*:* Versions 15 Running on ·SUSE
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-18905
- 2026-10-03 Alias added: GHSA-fp46-x6qh-pvgg
References
More SUSE vulnerabilities
- TI-2016-03560 Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2016-03506 Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
- TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-04302 Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-04301 Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-04298 Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-18905 · CVE Program
- CVE-2019-18905 · NVD
- FIRST EPSS
- GHSA-fp46-x6qh-pvgg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences