Description
The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing local attackers to access or corrupt the RMT database.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE | yast2-rmt | unspecified – < 1.1.2 | 1.1.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | yast2-rmt | 1.1.2-3.11.1 | SUSE-SU-2018:4209-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | yast2-rmt | 1.3.3-1.2 | openSUSE-SU-2024:11534-1 |
Advisories 2
- openSUSE-SU-2024:11534-1 yast2-rmt-1.3.3-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:4209-1 Security update for yast2-rmt SUSE / openSUSE Security Updates · May 2, 2025