autoyast2-4.4.16-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:10642-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z autoyast2-4.4.16-1.1 on GA media These are all security issues fixed in the autoyast2-4.4.16-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-10642 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2019-18905/ SUSE CVE CVE-2019-18905 page openSUSE Tumbleweed autoyast2-4.4.16-1.1 autoyast2-installation-4.4.16-1.1 autoyast2-4.4.16-1.1 as a component of openSUSE Tumbleweed autoyast2-installation-4.4.16-1.1 as a component of openSUSE Tumbleweed A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote attackers to MITM connections when deprecated and unused functionality of autoyast is used to create images. This issue affects: SUSE Linux Enterprise Server 12 autoyast2 version 4.1.9-3.9.1 and prior versions. SUSE Linux Enterprise Server 15 autoyast2 version 4.0.70-3.20.1 and prior versions. CVE-2019-18905 openSUSE Tumbleweed:autoyast2-4.4.16-1.1 openSUSE Tumbleweed:autoyast2-installation-4.4.16-1.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-18905.html CVE-2019-18905 https://bugzilla.suse.com/1140711 SUSE Bug 1140711