Description
A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2. openSUSE Leap yast2-rmt versions prior to 1.2.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE | SUSE Linux Enterprise Server 15 | yast2-rmt – < 1.2.2 | 1.2.2 |
| openSUSE | Leap | yast2-rmt – < 1.2.2 | 1.2.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | yast2-rmt | 1.3.0-3.5.1 | SUSE-SU-2020:0578-1 |
| SLES 15 | yast2-rmt | 1.2.2-3.18.1 | SUSE-SU-2019:0629-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | yast2-rmt | 1.3.3-1.2 | openSUSE-SU-2024:11534-1 |
| openSUSE Leap 15.1 | yast2-rmt | 1.2.2-lp151.2.3.1 | openSUSE-SU-2020:0320-1, openSUSE-SU-2020:0253-1 |
| openSUSE Leap 15.0 | yast2-rmt | 1.2.2-lp150.2.19.1 | openSUSE-SU-2019:1089-1 |
Advisories 6
- SUSE-SU-2020:0578-1 Security update for yast2-rmt SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1089-1 Security update for yast2-rmt SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11534-1 yast2-rmt-1.3.3-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0629-1 Security update for yast2-rmt SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0320-1 Security update for yast2-rmt SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0253-1 Security update for yast2-rmt SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://bugzilla.suse.com/show_bug.cgi?id=1119835
- openSUSE-SU-2020:0253 vendor-advisory
- openSUSE-SU-2020:0320 vendor-advisory