CVE-2018-20106

In yast2-printer up to and including version 4.0.2 the SMB printer settings don't escape characters in passwords properly. If a password with backticks or simliar characters is supplied this allows for executing code as root. This requires tricking root to enter such a password in yast.

Score

CVSS 3.0 8.1 High

Status

Modified - security@opentext.com

Published

2019-03-15

Last modified

2024-09-16

Weaknesses

CWE-20, CWE-78

Affected products

• Yast2-printer (Opensuse)
• Yast2-printer (Suse)

References

• https://bugzilla.suse.com/show_bug.cgi?id=1114853