CVE-2019-18904
Migrations requests can cause DoS on rmt
CVE-2019-18904 is a medium vulnerability (CVSS 6.5) in Opensuse Leap 15.1, published January 30, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.58%, the 75th percentile. Fixed in rmt-server 2.5.2-3.26.1.
A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux Enterprise Module for Server Applications 15-SP1, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1 allows remote attackers to cause DoS against rmt by requesting migrations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Public Cloud 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Module for Server Applications 15 rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Server Applications 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Server 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.5.2-3.26.1. openSUSE Leap 15.1 rmt-server versions prior to 2.5.2-lp151.2.9.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Migrations requests can cause DoS on rmt
A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux Enterprise Module for Server Applications 15-SP1, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1 allows remote attackers to cause DoS against rmt by requesting migrations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Public Cloud 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Module for Server Applications 15 rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Server Applications 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Server 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.5.2-3.26.1. openSUSE Leap 15.1 rmt-server versions prior to 2.5.2-lp151.2.9.1.
- Record
CVE-2019-18904- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2019-8585
A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux Enterprise Module for Server Applications 15-SP1, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1 allows remote attackers to cause DoS against rmt by requesting migrations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Public Cloud 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Module for Server Applications 15 rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Server Applications 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Server 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.5.2-3.26.1. openSUSE Leap 15.1 rmt-server versions prior to 2.5.2-lp151.2.9.1.
- Record
EUVD-2019-8585- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fpvp-5qrg-qr4v No score
A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High...
A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux Enterprise Module for Server Applications 15-SP1, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1 allows remote attackers to cause DoS against rmt by requesting migrations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Public Cloud 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Module for Server Applications 15 rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Server Applications 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Server 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.5.2-3.26.1. openSUSE Leap 15.1 rmt-server versions prior to 2.5.2-lp151.2.9.1.
- Record
GHSA-fpvp-5qrg-qr4v- Updated
- 2026-11-02
NVD
A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux Enterprise Module for Server Applications 15-SP1, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1 allows remote attackers to cause DoS against rmt by requesting migrations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Public Cloud 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Module for Server Applications 15 rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Server Applications 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Server 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.5.2-3.26.1. openSUSE Leap 15.1 rmt-server versions prior to 2.5.2-lp151.2.9.1.
- Record
CVE-2019-18904- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0235-1 No score
Security update for rmt-server
This update for rmt-server to version 2.5.2 fixes the following issues:
Security issue fixed:
- CVE-2019-18904: Fixed a denial of service in the offline migration (bsc#1160922).
Non-security issue fixed:
- Relaxed systemd units dependencies (bsc#1160673)
- Added more verbose error reporting for SCC API errors (bsc#1157119)
- Fixed system listing when architecture is not well referenced (bsc#1141122)
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2020:0235-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10589-1 No score
rmt-server-2.6.13-1.1 on GA media
These are all security issues fixed in the rmt-server-2.6.13-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10589-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0260-1 No score
Security update for rmt-server
This update for rmt-server to version 2.5.2 fixes the following issues:
Security issue fixed:
- CVE-2019-18904: Fixed a denial of service in the offline migration (bsc#1160922).
Non-security issue fixed:
- Relaxed systemd units dependencies (bsc#1160673)
- Added more verbose error reporting for SCC API errors (bsc#1157119)
- Fixed system listing when architecture is not well referenced (bsc#1141122)
- Record
SUSE-SU-2020:0260-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0278-1 No score
Security update for rmt-server
This update for rmt-server to version 2.5.2 fixes the following issues:
Security issue fixed:
- CVE-2019-18904: Fixed a denial of service in the offline migration (bsc#1160922).
Non-security issue fixed:
- Relaxed systemd units dependencies (bsc#1160673)
- Added more verbose error reporting for SCC API errors (bsc#1157119)
- Fixed system listing when architecture is not well referenced (bsc#1141122)
- Record
SUSE-SU-2020:0278-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:1179-1 No score
Security update for rmt-server
This update for rmt-server to version 2.5.7 fixes the following issues:
Security issues fixed:
- CVE-2019-18904: Fixed offline migrations (bsc#1160922).
- Fixed a local denial of service (bsc#1165548).
Non-security issues fixed:
- Align supported subscription types with SCC (bsc#1168554).
- Fix migrations in case adding migration_extra column failed (bsc#1162296).
- Fix dependency to removed boot_cli_i18n file (bsc#1136020)
- Record
SUSE-SU-2020:1179-1- Updated
- 2026-11-02
Affected products
- opensuse leap 15.1
- opensuse rmt-server
- suse linux enterprise high performance computing 15-espos
- suse linux enterprise high performance computing 15-ltss
- suse linux enterprise module for public cloud 15-sp1
- suse linux enterprise module for server applications 15
- suse linux enterprise module for server applications 15-sp1
- suse linux enterprise server 15-ltss
- suse linux enterprise server for sap 15
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rmt-serverSUSE:Linux Enterprise Module for Server Applications 15 |
before 2.5.2-3.26.1 | 2.5.2-3.26.1 |
rmt-serverSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 2.5.2-3.26.1 | 2.5.2-3.26.1 |
rmt-serverSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 2.5.2-3.26.1 | 2.5.2-3.26.1 |
rmt-serverSUSE:Linux Enterprise Server 15-LTSS |
before 2.5.2-3.26.1 | 2.5.2-3.26.1 |
rmt-serverSUSE:Linux Enterprise Server for SAP Applications 15 |
before 2.5.2-3.26.1 | 2.5.2-3.26.1 |
rmt-serverSUSE:Linux Enterprise Module for Public Cloud 15 SP1 |
before 2.5.2-3.9.1 | 2.5.2-3.9.1 |
rmt-serverSUSE:Linux Enterprise Module for Server Applications 15 SP1 |
before 2.5.2-3.9.1 | 2.5.2-3.9.1 |
rmt-serverSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 2.5.7-3.31.1 | 2.5.7-3.31.1 |
rmt-serverSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 2.5.7-3.31.1 | 2.5.7-3.31.1 |
rmt-serverSUSE:Linux Enterprise Server 15-LTSS |
before 2.5.7-3.31.1 | 2.5.7-3.31.1 |
rmt-serverSUSE:Linux Enterprise Server for SAP Applications 15 |
before 2.5.7-3.31.1 | 2.5.7-3.31.1 |
rmt-serveropenSUSE:Leap 15.1 |
before 2.5.2-lp151.2.9.1 | 2.5.2-lp151.2.9.1 |
rmt-serveropenSUSE:Tumbleweed |
before 2.6.13-1.1 | 2.6.13-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugzilla.suse.com/show_bug.cgi?id=1160922
nvd.nist.gov/vuln/detail/CVE-2019-18904
github.com/advisories/GHSA-fpvp-5qrg-qr4v
suse.com/support/update/announcement/2020/suse-su-20200260-1
Show 25 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/NDQBJNFWANV6TSPQYO64RQJGFMEBCGWR