Vulnerability in openSUSE Leap
CVE-2017-15638
The SuSEfirewall2 package before 3.6.312-2.13.1 in SUSE Linux Enterprise (SLE) Desktop 12 SP2, Server 12 SP2, and Server for Raspberry Pi 12 SP2; before 3.6.312.333-3.10.1 in SLE Desktop 12 SP3 and Server 12 SP3; before 3.6_SVNr208-2.18.3.1 in SLE Server 11 SP4; before 3.6.312-5.9.1 in openSUSE Leap 42.2; and before 3.6.312.333-7.1 in openSUSE Leap 42.3 might allow remote attackers to bypass intended access restrictions on the portmap service by leveraging a missing source net restriction for _rpc_ services.
EPSS: 0.012 (66.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L.
Affected products
- Opensuse Leap — versions 42.2, 42.3
- Suse Linux_enterprise_desktop — versions 12
- Suse Linux_enterprise_server — versions 11, 12
- Suse Linux_enterprise_server_for_raspberry_pi — versions 12
- Suse Susefirewall2
- N/a — versions n/a
References
- cve@mitre.org (vendor-advisory, x_refsource_SUSE, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-15638?
- CVE-2017-15638 is a medium-severity vulnerability in openSUSE Leap. CVSS score: 6.5/10. Published 2017-11-10.
- How severe is CVE-2017-15638?
- Medium severity. CVSS v3 base score is 6.5 out of 10.