How severe is CVE-2011-4190?

CVE-2011-4190 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2011-4190 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2011-4190?

CVE-2011-4190 primarily affects Suse Suse Linux Enterprise Desktop. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2011-4190?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2011-4190 published?

CVE-2011-4190 was published on 2018-06-08 and last updated on 2026-06-16.

CVE-2011-4190

CVE-2011-4190 is a medium-severity vulnerability in Suse Suse Linux Enterprise Desktop with a CVSS 3.x base score of 5.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-310.

Key facts

Severity: Medium (CVSS 3.x base score 5.9)
CVSS v2: 3.5
EPSS exploit prediction: 1% (51st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-310
Affected product: Suse Suse Linux Enterprise Desktop
Published: 2018-06-08
Last modified: 2026-06-16

Description

The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this flaw to impersonate the correct kdump server to obtain security sensitive information (kdump core files).

Frequently asked questions

What is CVE-2011-4190?: The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this flaw to impersonate the correct kdump server to obtain security sensitive information (kdump core files).
How severe is CVE-2011-4190?: CVE-2011-4190 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2011-4190 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2011-4190?: CVE-2011-4190 primarily affects Suse Suse Linux Enterprise Desktop. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2011-4190?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2011-4190 published?: CVE-2011-4190 was published on 2018-06-08 and last updated on 2026-06-16.

References

Affected products (4)

cpe:2.3:o:suse:suse_linux_enterprise_desktop:11:sp1:*:*:*:*:*:*
cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp1:*:*:*:*:*:*
cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp1:*:*:*:sap_aio:*:*
cpe:2.3:o:suse:suse_linux_enterprise_server:11.0:sp1:*:*:ltss:*:*:*

More vulnerabilities in Suse Suse Linux Enterprise Desktop

CVE-2015-0491 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and Java FX 2.2.76, allows remote attackers…
CVE-2015-3042 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before…
CVE-2015-3041 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before…
CVE-2015-3039 — Critical (CVSS 10.0): Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows…
CVE-2015-3038 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before…
CVE-2015-0360 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before…

All CVEs affecting Suse Suse Linux Enterprise Desktop →

Other CWE-310 (Cryptographic Issues) vulnerabilities

CVE-2014-7878 — Critical (CVSS 10.0): The Application Lifecycle Service (ALS) in HP Helion Cloud Development Platform 1.0, when a virtual machine is derived…
CVE-2013-3712 — Critical (CVSS 10.0): SUSE Studio Onsite 1.3.x before 1.3.6 and SUSE Studio Extension for System z 1.3 uses "static" secret tokens, which has…
CVE-2013-6952 — Critical (CVSS 10.0): The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key, which makes it easier for remote…
CVE-2013-6838 — Critical (CVSS 10.0): An unspecified Enghouse Interactive Professional Services "addon product" in Enghouse Interactive IVR Pro (VIP2000)…
CVE-2013-0137 — Critical (CVSS 10.0): The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189…
CVE-2011-5123 — Critical (CVSS 10.0): The Antivirus component in Comodo Internet Security before 5.3.175888.1227 does not check whether X.509 certificates in…

Browse all CWE-310 (Cryptographic Issues) vulnerabilities →