CVE Catalog
CVE-2016-1601
CriticalSummary
yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an AutoYaST installation when the profile does not contain inst-sys users.
Risk Assessment
This might allow attackers to have unspecified impact via unknown vectors, posing a security risk to the system.
Recommendation
It is recommended to update yast2-users to version 3.1.47 or later to mitigate this vulnerability.
Original NVD description (English source)
yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an AutoYaST installation when the profile does not contain inst-sys users, which might allow attackers to have unspecified impact via unknown vectors.