{"id":"CVE-2019-18904","aliases":["EUVD-2019-8585","GHSA-fpvp-5qrg-qr4v","SUSE-SU-2020:0260-1","SUSE-SU-2020:0278-1","SUSE-SU-2020:1179-1","openSUSE-SU-2020:0235-1","openSUSE-SU-2024:10589-1"],"status":"published","title":"Migrations requests can cause DoS on rmt","description":"A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux Enterprise Module for Server Applications 15-SP1, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1 allows remote attackers to cause DoS against rmt by requesting migrations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Public Cloud 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Module for Server Applications 15 rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Server Applications 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Server 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.5.2-3.26.1. openSUSE Leap 15.1 rmt-server versions prior to 2.5.2-lp151.2.9.1.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01585,"percentile":0.75788,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2020-01-30T08:04:17Z","modified":"2026-06-17T02:25:33Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"rmt-server","fixed_in":["2.5.2-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"rmt-server","fixed_in":["2.5.2-3.26.1","2.5.7-3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"rmt-server","fixed_in":["2.5.2-3.26.1","2.5.7-3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"rmt-server","fixed_in":["2.5.2-3.26.1","2.5.7-3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"rmt-server","fixed_in":["2.5.2-3.26.1","2.5.7-3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP1","package":"rmt-server","fixed_in":["2.5.2-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"rmt-server","fixed_in":["2.5.2-3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"rmt-server","fixed_in":["2.5.2-lp151.2.9.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP1","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.7-3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.7-3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.7-3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.7-3.31.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-lp151.2.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.13-1.1"}]}],"bundled":16}],"products":[{"vendor":"opensuse","product":"opensuse leap 15.1"},{"vendor":"opensuse","product":"rmt-server"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15-espos"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15-ltss"},{"vendor":"suse","product":"suse linux enterprise module for public cloud 15-sp1"},{"vendor":"suse","product":"suse linux enterprise module for server applications 15"},{"vendor":"suse","product":"suse linux enterprise module for server applications 15-sp1"},{"vendor":"suse","product":"suse linux enterprise server 15-ltss"},{"vendor":"suse","product":"suse linux enterprise server for sap 15"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1160922","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18904"},{"url":"https://github.com/advisories/GHSA-fpvp-5qrg-qr4v"},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200260-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1141122","tags":["report"]},{"url":"https://bugzilla.suse.com/1157119","tags":["report"]},{"url":"https://bugzilla.suse.com/1160673","tags":["report"]},{"url":"https://bugzilla.suse.com/1160922","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18904","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200278-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201179-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1136020","tags":["report"]},{"url":"https://bugzilla.suse.com/1162296","tags":["report"]},{"url":"https://bugzilla.suse.com/1165548","tags":["report"]},{"url":"https://bugzilla.suse.com/1168554","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NDQBJNFWANV6TSPQYO64RQJGFMEBCGWR/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8185","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-18904","title":"Migrations requests can cause DoS on rmt","description":"A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux Enterprise Module for Server Applications 15-SP1, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1 allows remote attackers to cause DoS against rmt by requesting migrations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Public Cloud 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Module for Server Applications 15 rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Server Applications 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Server 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.5.2-3.26.1. openSUSE Leap 15.1 rmt-server versions prior to 2.5.2-lp151.2.9.1.","status":"published","published":"2020-04-03T07:10:13.137Z","modified":"2024-09-16T16:58:59.728Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:32:23.803059Z"}],"euvd":[{"id":"EUVD-2019-8585","description":"A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux Enterprise Module for Server Applications 15-SP1, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1 allows remote attackers to cause DoS against rmt by requesting migrations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Public Cloud 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Module for Server Applications 15 rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Server Applications 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Server 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.5.2-3.26.1. openSUSE Leap 15.1 rmt-server versions prior to 2.5.2-lp151.2.9.1.","status":"published","published":"2020-04-03T07:10:13Z","modified":"2024-09-16T16:58:59Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:55:46.200652Z"}],"ghsa":[{"id":"GHSA-fpvp-5qrg-qr4v","title":"A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High...","description":"A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux Enterprise Module for Server Applications 15-SP1, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1 allows remote attackers to cause DoS against rmt by requesting migrations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Public Cloud 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Module for Server Applications 15 rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Server Applications 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Server 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.5.2-3.26.1. openSUSE Leap 15.1 rmt-server versions prior to 2.5.2-lp151.2.9.1.","status":"published","published":"2022-05-24T17:13:20Z","modified":"2023-01-29T05:02:04Z","updated_at":"2026-11-02T14:44:59.173471Z"}],"nvd":[{"id":"CVE-2019-18904","description":"A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux Enterprise Module for Server Applications 15-SP1, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1 allows remote attackers to cause DoS against rmt by requesting migrations. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Public Cloud 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Module for Server Applications 15 rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Module for Server Applications 15-SP1 rmt-server versions prior to 2.5.2-3.9.1. SUSE Linux Enterprise Server 15-LTSS rmt-server versions prior to 2.5.2-3.26.1. SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.5.2-3.26.1. openSUSE Leap 15.1 rmt-server versions prior to 2.5.2-lp151.2.9.1.","status":"published","published":"2020-04-03T07:15:11.507Z","modified":"2026-06-17T02:25:33.503Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:05:46.451008Z"}],"osv":[{"id":"openSUSE-SU-2020:0235-1","title":"Security update for rmt-server","description":"This update for rmt-server to version 2.5.2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-18904: Fixed a denial of service in the offline migration (bsc#1160922).\n\nNon-security issue fixed:\n\n- Relaxed systemd units dependencies (bsc#1160673)\n- Added more verbose error reporting for SCC API errors (bsc#1157119)\n- Fixed system listing when architecture is not well referenced (bsc#1141122)\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-02-19T19:13:45Z","modified":"2026-02-04T04:26:27.526375Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10589-1","title":"rmt-server-2.6.13-1.1 on GA media","description":"These are all security issues fixed in the rmt-server-2.6.13-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:28:48.695963Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2020:0260-1","title":"Security update for rmt-server","description":"This update for rmt-server to version 2.5.2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-18904: Fixed a denial of service in the offline migration (bsc#1160922).\n\nNon-security issue fixed:\n\n- Relaxed systemd units dependencies (bsc#1160673)\n- Added more verbose error reporting for SCC API errors (bsc#1157119)\n- Fixed system listing when architecture is not well referenced (bsc#1141122)\n","status":"published","published":"2020-01-30T08:04:17Z","modified":"2026-02-04T04:06:20.908741Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0278-1","title":"Security update for rmt-server","description":"This update for rmt-server to version 2.5.2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-18904: Fixed a denial of service in the offline migration (bsc#1160922).\n\nNon-security issue fixed:\n\n- Relaxed systemd units dependencies (bsc#1160673)\n- Added more verbose error reporting for SCC API errors (bsc#1157119)\n- Fixed system listing when architecture is not well referenced (bsc#1141122)\n","status":"published","published":"2020-01-31T10:33:58Z","modified":"2026-02-04T02:55:54.986301Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:1179-1","title":"Security update for rmt-server","description":"This update for rmt-server to version 2.5.7 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-18904: Fixed offline migrations (bsc#1160922).\n- Fixed a local denial of service (bsc#1165548).\n\nNon-security issues fixed:\n\n- Align supported subscription types with SCC (bsc#1168554).\n- Fix migrations in case adding migration_extra column failed (bsc#1162296).\n- Fix dependency to removed boot_cli_i18n file (bsc#1136020)\n","status":"published","published":"2020-05-05T08:28:13Z","modified":"2026-02-04T03:44:24.164094Z","updated_at":"2026-11-02T15:53:47.634847Z"}]}}