SUSE update for libosinfo
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2019-13313 |
| CWE-ID | CWE-255 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
SUSE Linux Enterprise Software Development Kit 12 Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 12 Operating systems & Components / Operating system SUSE Linux Enterprise Server 12 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 12 Operating systems & Components / Operating system libosinfo-lang Operating systems & Components / Operating system package or component libosinfo-1_0-0-debuginfo Operating systems & Components / Operating system package or component libosinfo Operating systems & Components / Operating system package or component libosinfo-1_0-0 Operating systems & Components / Operating system package or component typelib-1_0-Libosinfo-1_0 Operating systems & Components / Operating system package or component libosinfo-devel Operating systems & Components / Operating system package or component libosinfo-debuginfo Operating systems & Components / Operating system package or component libosinfo-debugsource Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Credentials management
EUVDB-ID: #VU33176
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-13313
CWE-ID:
CWE-255 - Credentials Management
Exploit availability: No
DescriptionThe vulnerability allows a local authenticated user to execute arbitrary code.
libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line.
MitigationUpdate the affected package libosinfo to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Software Development Kit 12: SP5
SUSE Linux Enterprise Server for SAP Applications 12: SP5
SUSE Linux Enterprise Server 12: SP5
SUSE Linux Enterprise High Performance Computing 12: SP5
libosinfo-lang: before 1.2.0-3.3.2
libosinfo-1_0-0-debuginfo: before 1.2.0-3.3.2
libosinfo: before 1.2.0-3.3.2
libosinfo-1_0-0: before 1.2.0-3.3.2
typelib-1_0-Libosinfo-1_0: before 1.2.0-3.3.2
libosinfo-devel: before 1.2.0-3.3.2
libosinfo-debuginfo: before 1.2.0-3.3.2
libosinfo-debugsource: before 1.2.0-3.3.2
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit_12:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:libosinfo-lang:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libosinfo-1_0-0-debuginfo:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libosinfo:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libosinfo-1_0-0:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:typelib-1_0-libosinfo-1_0:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libosinfo-devel:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libosinfo-debuginfo:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:libosinfo-debugsource:*:*:*:*:*:suse_linux:*:
http://www.suse.com/support/update/announcement/2024/suse-su-20241700-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
