Description
In yast2-samba-provision up to and including version 1.0.1 the password for samba shares was provided on the command line to tools used by yast2-samba-provision, allowing local attackers to read them in the process list
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE | yast2-samba-provision | unspecified – ≤ 1.0.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | yast2-samba-provision | 1.0.5-150400.9.3.3 | SUSE-SU-2022:3199-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | yast2-samba-provision | 1.0.5-1.2 | openSUSE-SU-2024:11535-1 |
| openSUSE Leap 15.4 | yast2-samba-provision | 1.0.5-150400.9.3.3 | SUSE-SU-2022:3199-1 |
Advisories 2
- openSUSE-SU-2024:11535-1 yast2-samba-provision-1.0.5-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3199-1 Security update for yast2-samba-provision SUSE / openSUSE Security Updates · Feb 4, 2026