{"id":"CVE-2019-18906","aliases":["EUVD-2019-8587","GHSA-x9cr-r4j4-8ph8","SUSE-SU-2021:2136-1","SUSE-SU-2021:2137-1","openSUSE-SU-2021:0907-1","openSUSE-SU-2021:2136-1","openSUSE-SU-2024:12078-1"],"status":"published","title":"cryptctl: client side password hashing is equivalent to clear text password storage","description":"A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01111,"percentile":0.66218,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2021-06-23T11:40:27Z","modified":"2026-06-17T02:25:33Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"cryptctl","fixed_in":["2.4-4.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"cryptctl","fixed_in":["2.4-4.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for SAP Applications 15","package":"cryptctl","fixed_in":["2.4-4.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for SAP Applications 15 SP1","package":"cryptctl","fixed_in":["2.4-4.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"cryptctl","fixed_in":["2.4-4.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"cryptctl","fixed_in":["2.4-4.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"cryptctl","fixed_in":["2.4-4.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"cryptctl","fixed_in":["2.4-4.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"cryptctl","fixed_in":["2.4-4.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.0","package":"cryptctl","fixed_in":["2.4-4.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"cryptctl","fixed_in":["2.4-4.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.0","package":"cryptctl","fixed_in":["2.4-4.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"cryptctl","fixed_in":["2.4-4.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"cryptctl","fixed_in":["2.4-2.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"cryptctl","fixed_in":["2.4-2.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"cryptctl","fixed_in":["2.4-2.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"cryptctl","fixed_in":["2.4-2.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"cryptctl","fixed_in":["2.4-lp152.5.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"cryptctl","fixed_in":["2.4-4.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cryptctl","fixed_in":["2.4-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-4.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-4.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for SAP Applications 15","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-4.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for SAP Applications 15 SP1","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-4.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-4.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-4.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-4.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-4.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-4.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-4.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-4.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-4.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-4.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-2.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-2.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-2.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-2.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-2.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-2.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-2.10.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-lp152.5.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-4.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cryptctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-1.1"}]}]}],"products":[{"vendor":"opensuse","product":"cryptctl"},{"vendor":"suse","product":"suse linux enterprise server for sap 12-sp5"},{"vendor":"suse","product":"suse manager server 4.0"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1186226","tags":["x_transferred","Issue Tracking","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18906"},{"url":"https://github.com/advisories/GHSA-x9cr-r4j4-8ph8"},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212136-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186226","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18906","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212137-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DGYSYGNUS4QKFOUUYGCDWJ7IFEVXEUO2/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZG2JNQUB6EYLM4HAOZIJV25FIOJAG6B6/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-18906","title":"cryptctl: client side password hashing is equivalent to clear text password storage","description":"A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4.","status":"published","published":"2021-06-30T08:35:12.084Z","modified":"2024-09-16T21:03:41.876Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:32:23.485011Z"}],"euvd":[{"id":"EUVD-2019-8587","description":"A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4.","status":"published","published":"2021-06-30T08:35:12Z","modified":"2024-09-16T21:03:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:55:08.578591Z"}],"ghsa":[{"id":"GHSA-x9cr-r4j4-8ph8","title":"A Use of Password Hash Instead of Password for Authentication vulnerability in cryptctl of SUSE...","description":"A Use of Password Hash Instead of Password for Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4.","status":"published","published":"2022-05-24T19:06:41Z","modified":"2023-01-27T05:03:20Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:42:13.302487Z"}],"nvd":[{"id":"CVE-2019-18906","description":"A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4.","status":"published","published":"2021-06-30T09:15:07.847Z","modified":"2026-06-17T02:25:33.79Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:05:48.502374Z"}],"osv":[{"id":"openSUSE-SU-2021:0907-1","title":"Security update for cryptctl","description":"This update for cryptctl fixes the following issues:\n\nUpdate to version 2.4:\n\n- CVE-2019-18906: Client side password hashing was equivalent to clear text password storage (bsc#1186226)\n- First step to use plain text password instead of hashed password.\n- Move repository into the SUSE github organization\n- in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address\n- tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case\n- avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server.\n","status":"published","published":"2021-06-24T09:52:39Z","modified":"2026-02-04T03:48:32.034221Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:2136-1","title":"Security update for cryptctl","description":"This update for cryptctl fixes the following issues:\n\nUpdate to version 2.4:\n\n- CVE-2019-18906: Client side password hashing was equivalent to clear text password storage (bsc#1186226)\n- First step to use plain text password instead of hashed password.\n- Move repository into the SUSE github organization\n- in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address\n- tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case\n- avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server.\n","status":"published","published":"2021-07-10T16:46:21Z","modified":"2026-02-04T04:37:41.387929Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:12078-1","title":"cryptctl-2.4-1.1 on GA media","description":"These are all security issues fixed in the cryptctl-2.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:42:04.866659Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2021:2136-1","title":"Security update for cryptctl","description":"This update for cryptctl fixes the following issues:\n\nUpdate to version 2.4:\n\n- CVE-2019-18906: Client side password hashing was equivalent to clear text password storage (bsc#1186226)\n- First step to use plain text password instead of hashed password.\n- Move repository into the SUSE github organization\n- in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address\n- tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case\n- avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server.\n","status":"published","published":"2021-06-23T11:40:27Z","modified":"2026-02-04T02:20:09.85746Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2137-1","title":"Security update for cryptctl","description":"This update for cryptctl fixes the following issues:\n\nUpdate to version 2.4:\n\n- CVE-2019-18906: Client side password hashing was equivalent to clear text password storage (bsc#1186226)\n- First step to use plain text password instead of hashed password.\n- Move repository into the SUSE github organization\n- in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address\n- tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case\n- avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server.\n","status":"published","published":"2021-06-23T11:40:42Z","modified":"2026-02-04T03:30:10.541276Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}