Security update for yast2-rmt SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:4209-1 Final 1 1 2018-12-20T21:05:23Z current 2018-12-20T21:05:23Z 2018-12-20T21:05:23Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for yast2-rmt This update for yast2-rmt to version 1.1.12 fixes the following issues: Security issue fixed: - CVE-2018-17957: Secure MySQL credentials by not exposing them on the command line (bsc#1117602) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Module-Server-Applications-15-2018-3012 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20184209-1/ Link for SUSE-SU-2018:4209-1 https://lists.suse.com/pipermail/sle-security-updates/2018-December/004991.html E-Mail link for SUSE-SU-2018:4209-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1117602 SUSE Bug 1117602 https://www.suse.com/security/cve/CVE-2018-17957/ SUSE CVE CVE-2018-17957 page SUSE Linux Enterprise Module for Server Applications 15 yast2-rmt-1.1.2-3.11.1 yast2-rmt-1.1.2-3.11.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing local attackers to access or corrupt the RMT database. CVE-2018-17957 SUSE Linux Enterprise Module for Server Applications 15:yast2-rmt-1.1.2-3.11.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20184209-1/ https://www.suse.com/security/cve/CVE-2018-17957.html CVE-2018-17957 https://bugzilla.suse.com/1117602 SUSE Bug 1117602