Security update for cryptctl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:2137-1 Final 1 1 2021-06-23T11:40:42Z current 2021-06-23T11:40:42Z 2021-06-23T11:40:42Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for cryptctl This update for cryptctl fixes the following issues: Update to version 2.4: - CVE-2019-18906: Client side password hashing was equivalent to clear text password storage (bsc#1186226) - First step to use plain text password instead of hashed password. - Move repository into the SUSE github organization - in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address - tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case - avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP4-SAP-Azure-LI-BYOS-Production-2021-2137,Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production-2021-2137,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2021-2137,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2021-2137,SUSE-2021-2137,SUSE-SLE-SAP-12-SP3-2021-2137,SUSE-SLE-SAP-12-SP4-2021-2137,SUSE-SLE-SAP-12-SP5-2021-2137,SUSE-SLE-SERVER-12-SP5-2021-2137 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20212137-1/ Link for SUSE-SU-2021:2137-1 https://lists.suse.com/pipermail/sle-security-updates/2021-June/009075.html E-Mail link for SUSE-SU-2021:2137-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1186226 SUSE Bug 1186226 https://www.suse.com/security/cve/CVE-2019-18906/ SUSE CVE CVE-2019-18906 page Image SLES12-SP4-SAP-Azure-LI-BYOS-Production Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 cryptctl-2.4-2.10.1 cryptctl-2.4-2.10.1 as a component of Image SLES12-SP4-SAP-Azure-LI-BYOS-Production cryptctl-2.4-2.10.1 as a component of Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production cryptctl-2.4-2.10.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production cryptctl-2.4-2.10.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production cryptctl-2.4-2.10.1 as a component of SUSE Linux Enterprise Server 12 SP5 cryptctl-2.4-2.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 cryptctl-2.4-2.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 cryptctl-2.4-2.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 cryptctl-2.4-2.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4. CVE-2019-18906 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:cryptctl-2.4-2.10.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:cryptctl-2.4-2.10.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:cryptctl-2.4-2.10.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:cryptctl-2.4-2.10.1 SUSE Linux Enterprise Server 12 SP5:cryptctl-2.4-2.10.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:cryptctl-2.4-2.10.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:cryptctl-2.4-2.10.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:cryptctl-2.4-2.10.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212137-1/ https://www.suse.com/security/cve/CVE-2019-18906.html CVE-2019-18906 https://bugzilla.suse.com/1186226 SUSE Bug 1186226