CVE-2019-18900
libzypp stores cookies world readable
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 16.21.2-27.68.1, 16.21.2-2.45.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1.
Timeline
- CVE published
- Record last updated
Affected versions
- SUSE CaaS Platform 3.0
From libzypp · fixed in 16.21.2-27.68.1
- SUSE SUSE Linux Enterprise Server 12
From libzypp · fixed in 16.21.2-2.45.1
- SUSE SUSE Linux Enterprise Server 15
libzypp 17.19.0-3.34.1