CVE catalog

CVE-2019-18906

Security update for cryptctl

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.11% · Oct 25, 2026

This update for cryptctl fixes the following issues: Update to version 2.4: - CVE-2019-18906: Client side password hashing was equivalent to clear text password storage (bsc#1186226) - First step to use plain text password instead of hashed password. - Move repository into the SUSE github organization - in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address - tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case - avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Opensusecryptctlleap 15.32.4-4.5.1fixed
Opensusecryptctlleap 15.22.4-lp152.5.3.1fixed
Susecryptctllinux enterprise server for sap applications 12 sp32.4-2.10.1fixed
Susecryptctllinux enterprise server for sap applications 12 sp42.4-2.10.1fixed
Susecryptctllinux enterprise server for sap applications 12 sp52.4-2.10.1fixed
Susecryptctllinux enterprise server 12 sp52.4-2.10.1fixed
Opensusecryptctltumbleweed2.4-1.1fixed
Susecryptctllinux enterprise module for basesystem 15 sp22.4-4.5.1fixed
Susecryptctllinux enterprise module for basesystem 15 sp32.4-4.5.1fixed
Susecryptctllinux enterprise module for sap applications 152.4-4.5.1fixed
Susecryptctllinux enterprise module for sap applications 15 sp12.4-4.5.1fixed
Susecryptctllinux enterprise high performance computing 15 sp1-espos2.4-4.5.1fixed
Susecryptctllinux enterprise high performance computing 15 sp1-ltss2.4-4.5.1fixed
Susecryptctllinux enterprise server 15 sp1-bcl2.4-4.5.1fixed
Susecryptctllinux enterprise server 15 sp1-ltss2.4-4.5.1fixed
Susecryptctllinux enterprise server for sap applications 15 sp12.4-4.5.1fixed
Susecryptctlmanager proxy 4.02.4-4.5.1fixed
Susecryptctlmanager retail branch server 4.02.4-4.5.1fixed
Susecryptctlmanager server 4.02.4-4.5.1fixed
Susecryptctlenterprise storage 62.4-4.5.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Opensusecryptctlrpmleap 15.32.4-4.5.1Not reportedOPENSUSE-SU-2021:2136-1Not reported
Opensusecryptctlrpmleap 15.22.4-lp152.5.3.1Not reportedOPENSUSE-SU-2021:0907-1Not reported
Susecryptctlrpmlinux enterprise server for sap applications 12 sp32.4-2.10.1Not reportedSUSE-SU-2021:2137-1Not reported
Susecryptctlrpmlinux enterprise server for sap applications 12 sp42.4-2.10.1Not reportedSUSE-SU-2021:2137-1Not reported
Susecryptctlrpmlinux enterprise server for sap applications 12 sp52.4-2.10.1Not reportedSUSE-SU-2021:2137-1Not reported
Susecryptctlrpmlinux enterprise server 12 sp52.4-2.10.1Not reportedSUSE-SU-2021:2137-1Not reported
Opensusecryptctlrpmtumbleweed2.4-1.1Not reportedOPENSUSE-SU-2024:12078-1Not reported
Susecryptctlrpmlinux enterprise module for basesystem 15 sp22.4-4.5.1Not reportedSUSE-SU-2021:2136-1Not reported
Susecryptctlrpmlinux enterprise module for basesystem 15 sp32.4-4.5.1Not reportedSUSE-SU-2021:2136-1Not reported
Susecryptctlrpmlinux enterprise module for sap applications 152.4-4.5.1Not reportedSUSE-SU-2021:2136-1Not reported
Susecryptctlrpmlinux enterprise module for sap applications 15 sp12.4-4.5.1Not reportedSUSE-SU-2021:2136-1Not reported
Susecryptctlrpmlinux enterprise high performance computing 15 sp1-espos2.4-4.5.1Not reportedSUSE-SU-2021:2136-1Not reported
Susecryptctlrpmlinux enterprise high performance computing 15 sp1-ltss2.4-4.5.1Not reportedSUSE-SU-2021:2136-1Not reported
Susecryptctlrpmlinux enterprise server 15 sp1-bcl2.4-4.5.1Not reportedSUSE-SU-2021:2136-1Not reported
Susecryptctlrpmlinux enterprise server 15 sp1-ltss2.4-4.5.1Not reportedSUSE-SU-2021:2136-1Not reported
Susecryptctlrpmlinux enterprise server for sap applications 15 sp12.4-4.5.1Not reportedSUSE-SU-2021:2136-1Not reported
Susecryptctlrpmmanager proxy 4.02.4-4.5.1Not reportedSUSE-SU-2021:2136-1Not reported
Susecryptctlrpmmanager retail branch server 4.02.4-4.5.1Not reportedSUSE-SU-2021:2136-1Not reported
Susecryptctlrpmmanager server 4.02.4-4.5.1Not reportedSUSE-SU-2021:2136-1Not reported
Susecryptctlrpmenterprise storage 62.4-4.5.1Not reportedSUSE-SU-2021:2136-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [cryptctl]Fixed

    Source package: [cryptctl]

    Details (1)

    • 2.4-1.18 · x86_64 · tumbleweed

      Fixed · Fixed: 2.4-1.1

      pypi · cryptctl · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]