PT-2018-8494 · Cryptctl+1 · Cryptctl+1

Sebastian Krahmer · Published 2017-07-14 · Updated 2019-10-09 · CVE-2017-9270

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cryptctl versions prior to 2.0

Description A malicious server could send RPC requests to overwrite files outside of the cryptctl key database.

Recommendations For versions prior to 2.0, update to version 2.0 or later to resolve the issue.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-20

CWE-22

Related Identifiers

CVE-2017-9270

SUSE-SU-2017:1865-1

SUSE-SU-2017_1865-1

Affected Products

Suse

Cryptctl

References · 12

• https://lists.opensuse.org/opensuse-security-announce/2017-07/msg00022.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-9270 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9270 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:1865-1 · Vendor Advisory
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note
• https://lists.suse.com/pipermail/sle-security-updates/2017-July/003033.html · Note
• https://suse.com/de-de/security/cve/CVE-2017-9270 · Note
• https://suse.com/support/update/announcement/2017/suse-su-20171865-1 · Note
• https://suse.com/security/cve/CVE-2017-9270 · Note
• https://suse.com/security/cve/CVE-2017-9270.html · Note
• https://bugzilla.suse.com/1041963 · Note
• https://bugzilla.suse.com/show_bug.cgi?id=1041963 · Note