Description
A SQL Injection in the RegistrationSharing module of SUSE Linux SMT allows remote attackers to cause execute arbitrary SQL statements. Affected releases are SUSE Linux SMT: versions prior to 3.0.37.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE Linux | SMT | unspecified – < 3.0.37 | 3.0.37 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-1 |
| SLES 12 SP2 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-2, SUSE-SU-2018:2898-1 |
| SLES 12 SP1 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-1 |
| SLES 12 SP1 | yast2-smt | 3.0.14-10.6.2 | SUSE-SU-2018:2898-1 |
| SLES 12 | perl-File-Touch | 0.11-3.2.2 | SUSE-SU-2018:2898-1 |
| SLES 12 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Subscription Management Tool 11 SP3 | smt | 2.0.34-50.8.1 | SUSE-SU-2018:2899-1 |
| SLES for SAP 12 SP3 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-1 |
| SLES for SAP 12 SP2 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-1 |
| SLES for SAP 12 SP1 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-1 |
| SLES for SAP 12 SP1 | yast2-smt | 3.0.14-10.6.2 | SUSE-SU-2018:2898-1 |
| SUSE OpenStack Cloud 7 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-1 |
| SUSE Enterprise Storage 4 | smt | 3.0.37-52.23.6 | SUSE-SU-2018:2898-1 |
Advisories 3
- SUSE-SU-2018:2899-1 Security update for smt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2898-2 Security update for smt, yast2-smt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2898-1 Security update for smt, yast2-smt SUSE / openSUSE Security Updates · Feb 4, 2026