CVE-2018-20105
yast2-rmt exposes CA private key passhrase in log-file
CVE-2018-20105 is a medium vulnerability (CVSS 4.0) in Hcl Software Leap, published March 18, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 36th percentile. Fixed in yast2-rmt 1.2.2-3.18.1.
A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2. openSUSE Leap yast2-rmt versions prior to 1.2.2.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
yast2-rmt exposes CA private key passhrase in log-file
A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2. openSUSE Leap yast2-rmt versions prior to 1.2.2.
- Record
CVE-2018-20105- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
EUVDEUVD-2018-12675
A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2. openSUSE Leap yast2-rmt versions prior to 1.2.2.
- Record
EUVD-2018-12675- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j4cc-p6fj-6598 No score
A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux...
A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2. openSUSE Leap yast2-rmt versions prior to 1.2.2.
- Record
GHSA-j4cc-p6fj-6598- Updated
- 2026-11-02
NVD
A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2. openSUSE Leap yast2-rmt versions prior to 1.2.2.
- Record
CVE-2018-20105- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1089-1 No score
Security update for yast2-rmt
This update for yast2-rmt to 1.2.2 fixes the following issues:
Security issue fixed:
- CVE-2018-20105: Pass SSL password to Cheetah CLI interface securely (bsc#1119835)
Non-security issues fixed:
- Launch as root from gnome-shell menu (bsc#1123562)
- Remove broken hyperlink from help (bsc#1120672)
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1089-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0253-1 No score
Security update for yast2-rmt
This update for yast2-rmt fixes the following issues:
yast2-rmt was updated to release version 1.2.2:
- CVE-2018-20105: Pass SSL password to Cheetah CLI interface securely (boo#1119835)
- Record
openSUSE-SU-2020:0253-1- Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2020:0320-1 No score
Security update for yast2-rmt
This update for yast2-rmt to version 1.3.0 fixes the following issues:
Security issue fixed:
- CVE-2018-20105: Fixed an exposure of the CA private key passphrase in the log file (bsc#1119835).
Non-security issue fixed:
- Add support for forwarding registration data from RMT to SCC
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2020:0320-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11534-1 No score
yast2-rmt-1.3.3-1.2 on GA media
These are all security issues fixed in the yast2-rmt-1.3.3-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11534-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:0629-1 No score
Security update for yast2-rmt
This update for yast2-rmt to 1.2.2 fixes the following issues:
Security issue fixed:
- CVE-2018-20105: Pass SSL password to Cheetah CLI interface securely (bsc#1119835)
Non-security issues fixed:
- Launch as root from gnome-shell menu (bsc#1123562)
- Remove broken hyperlink from help (bsc#1120672)
- Record
SUSE-SU-2019:0629-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0578-1 No score
Security update for yast2-rmt
This update for yast2-rmt to version 1.3.0 fixes the following issues:
Security issue fixed:
- CVE-2018-20105: Fixed an exposure of the CA private key passphrase in the log file (bsc#1119835).
Non-security issue fixed:
- Add support for forwarding registration data from RMT to SCC
- Record
SUSE-SU-2020:0578-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
yast2-rmtSUSE:Linux Enterprise Module for Server Applications 15 |
before 1.2.2-3.18.1 | 1.2.2-3.18.1 |
yast2-rmtSUSE:Linux Enterprise Module for Server Applications 15 SP1 |
before 1.3.0-3.5.1 | 1.3.0-3.5.1 |
yast2-rmtopenSUSE:Leap 15.0 |
before 1.2.2-lp150.2.19.1 | 1.2.2-lp150.2.19.1 |
yast2-rmtopenSUSE:Leap 15.1 |
before 1.2.2-lp151.2.3.1 | 1.2.2-lp151.2.3.1 |
yast2-rmtopenSUSE:Leap 15.1 |
before 1.3.0-lp151.2.6.1 | 1.3.0-lp151.2.6.1 |
yast2-rmtopenSUSE:Tumbleweed |
before 1.3.3-1.2 | 1.3.3-1.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, products | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugzilla.suse.com/show_bug.cgi?id=1119835
lists.opensuse.org/opensuse-security-announce/2020-02/msg00035.html
nvd.nist.gov/vuln/detail/CVE-2018-20105
github.com/advisories/GHSA-j4cc-p6fj-6598
suse.com/support/update/announcement/2019/suse-su-20190629-1
Show 10 moreShow less