CVE-2018-17957

yast2-rmt leaks database passwords in process list

3.4 LowFix available

The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing local attackers to access or corrupt the RMT database.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.38%Unchanged since Apr 14, 2021

What each source reports

CVE List Score used 3.4

yast2-rmt leaks database passwords in process list

Record: CVE-2018-17957
CVSS 3.0: 3.4 LowCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-214
Updated: 2026-11-02

EUVDEUVD-2018-9698 3.4

Record: EUVD-2018-9698
CVSS 3.0: 3.4 LowCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hr76-mvvj-82f3 7.8

The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2...

Record: GHSA-hr76-mvvj-82f3
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-287
Updated: 2026-11-02

NVD 3.4

Record: CVE-2018-17957
CVSS 3.0: 3.4 LowCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-214, CWE-287
Updated: 2026-11-02

OSV 7.8

Record: CVE-2018-17957
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11534-1 No score

yast2-rmt-1.3.3-1.2 on GA media

These are all security issues fixed in the yast2-rmt-1.3.3-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11534-1
Updated: 2026-11-02

OSVSUSE-SU-2018:4209-1 No score

Security update for yast2-rmt

This update for yast2-rmt to version 1.1.12 fixes the following issues:

Security issue fixed:

CVE-2018-17957: Secure MySQL credentials by not exposing them on the command line (bsc#1117602)

Record: SUSE-SU-2018:4209-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`yast2-rmt` SUSE:Linux Enterprise Module for Server Applications 15	before 1.1.2-3.11.1	1.1.2-3.11.1
`yast2-rmt` openSUSE:Tumbleweed From an advisory covering 2 CVEs	before 1.3.3-1.2	1.3.3-1.2

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-17957 is a low vulnerability (CVSS 3.4) in Suse Repository Mirroring Tool, published December 20, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in yast2-rmt 1.1.2-3.11.1.