Yast2 Users
Monthly
OS command injection in yast2-users (through version 5.0.8) allows root-level arbitrary command execution on SUSE Linux systems when an administrator views a malicious LDAP user's Password Settings tab. The `get_password_term()` function reads `shadowLastChange` and `shadowExpire` LDAP attributes without numeric validation and passes them to `format_days_after_epoch()`, which interpolates the values directly into a shell command executed via Ruby backticks. No public exploit or CISA KEV listing has been confirmed at time of analysis; EPSS data is unavailable.
OS command injection in yast2-users (through version 5.0.8) allows root-level arbitrary command execution on SUSE Linux systems when an administrator views a malicious LDAP user's Password Settings tab. The `get_password_term()` function reads `shadowLastChange` and `shadowExpire` LDAP attributes without numeric validation and passes them to `format_days_after_epoch()`, which interpolates the values directly into a shell command executed via Ruby backticks. No public exploit or CISA KEV listing has been confirmed at time of analysis; EPSS data is unavailable.