CVE-2018-19639— Code execution if run with command line switch -v
Quick assessment
Affected
SUSE supportutils
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SUSE Supportutils是德国SUSE公司的一款使用在SUSE Linux系统中实用程序集。该产品具有收集系统故障排除信息、读取和解释basic-health-check.txt文件、对内核核心文件执行简要分析等功能。 SUSE Supportutils中存在命令注入漏洞。攻击者可利用该漏洞执行代码。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-19639
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Code execution if run with command line switch -v
Source: CVE Program / CVE List V5
Vulnerability Description
If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as root.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
SUSE Supportutils 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SUSE Supportutils是德国SUSE公司的一款使用在SUSE Linux系统中实用程序集。该产品具有收集系统故障排除信息、读取和解释basic-health-check.txt文件、对内核核心文件执行简要分析等功能。 SUSE Supportutils中存在命令注入漏洞。攻击者可利用该漏洞执行代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SUSE | supportutils | unspecified ~ 3.1-5.7.1 | - |
|
II. Public POCs for CVE-2018-19639
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-19639
请登录查看更多情报信息。
Vendor Advisories for CVE-2018-19639 (1)
-
https://bugzilla.suse.com/show_bug.cgi?id=1118462 x_refsource_CONFIRM
Mailing List Discussions for CVE-2018-19639 (1)
-
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00018.html vendor-advisory x_refsource_SUSE
Same Patch Batch · SUSE · 2019-03-05 · 5 CVEs total
| CVE-2018-19636 | Local root exploit via inclusion of attacker controlled shell script | |
| CVE-2018-19637 | Static temporary filename allows overwriting of files | |
| CVE-2018-19638 | User can overwrite arbitrary log files in support tar | |
| CVE-2018-19640 | Code execution if run with command line switch -v |
IV. Related Vulnerabilities
Same product: supportutils
Same vendor: SUSE
-
CVE-2026-44945
Cross-Cluster Impersonation Confused-Deputy Privilege Escala -
CVE-2026-25703
Potential information leakage from manager /network/graph AP -
CVE-2026-55998
Cluster Existence Oracle via Unauthenticated Import Endpoint -
CVE-2026-59675
Rancher Audit-Log Middleware Unauthenticated Memory Exhausti -
CVE-2026-55996
Unauthenticated Denial-of-Service via TLS SAN Stuffing in Ra
Same weakness: CWE-78
-
CVE-2026-45018
Chainlit: Command injection via MCP stdio transport allows u -
CVE-2026-76195
Adobe Campaign Classic (ACC) | Improper Neutralization of Sp -
CVE-2026-76197
Adobe Campaign Classic (ACC) | Improper Neutralization of Sp -
CVE-2026-79992
Emacs: local shell command injection through the user field -
CVE-2026-55580
mcp-shell — Security Disabled by Default in Bare-Binary Depl
V. Comments for CVE-2018-19639
No comments yet