CVE-2019-18906

A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4.

A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4.

A Use of Password Hash Instead of Password for Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4.

A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4.

This update for cryptctl fixes the following issues:

Update to version 2.4:

• CVE-2019-18906: Client side password hashing was equivalent to clear text password storage (bsc#1186226)
• First step to use plain text password instead of hashed password.
• Move repository into the SUSE github organization
• in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address
• tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case
• avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server.

This update for cryptctl fixes the following issues:

Update to version 2.4:

• CVE-2019-18906: Client side password hashing was equivalent to clear text password storage (bsc#1186226)
• First step to use plain text password instead of hashed password.
• Move repository into the SUSE github organization
• in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address
• tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case
• avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server.

These are all security issues fixed in the cryptctl-2.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for cryptctl fixes the following issues:

Update to version 2.4:

• CVE-2019-18906: Client side password hashing was equivalent to clear text password storage (bsc#1186226)
• First step to use plain text password instead of hashed password.
• Move repository into the SUSE github organization
• in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address
• tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case
• avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server.

This update for cryptctl fixes the following issues:

Update to version 2.4:

• CVE-2019-18906: Client side password hashing was equivalent to clear text password storage (bsc#1186226)
• First step to use plain text password instead of hashed password.
• Move repository into the SUSE github organization
• in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address
• tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case
• avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server.