Description
In cryptctl before version 2.0 a malicious server could send RPC requests that could overwrite files outside of the cryptctl key database.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE | cryptctl | unspecified – < 2.0 | 2.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP2 | cryptctl | 1.2.6-5.3.11 | SUSE-SU-2017:1865-1 |
Advisories 1
- SUSE-SU-2017:1865-1 Security update for cryptctl SUSE / openSUSE Security Updates · Feb 4, 2026