CVE-2019-3700 json
yast: Fallback to DES without configuration in /etc/login.def
published 2020-01-24 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-13335
- cvss
- 2.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 1%
- public exploits
- 0
- none known
Summary
yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were moved to a different location. As of the 20191022 snapshot the insecure default settings were used until yast2-security switched to stronger defaults in 4.2.6 and used the new configuration file locations. Password created during this time used DES password encryption and are not properly protected against attackers that are able to access the password hashes.
Patch / fix
- openSUSE Factory 4.2.6
- yast2-security openSUSE Tumbleweed 4.4.1-1.2
opensuse advisories openSUSE-SU-2024:11536-1
Exploit prediction
0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.9 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- openSUSE Factory
Classification
- Weakness
-
- CWE-327 Use of a Broken or Risky Cryptographic Algorithm
References
-
bugzilla.suse.com
/show_bug.cgi?id=1157541
issue-tracking, vendor-advisory
Sources
- CVE List CVE-2019-3700
- NVD CVE-2019-3700
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.