<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">CVE-2019-14299</DocumentTitle>
  <DocumentType>SUSE CVE</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE CVE-2019-14299</ID>
    </Identification>
    <Status>Interim</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>12</Number>
        <Date>2025-02-17T02:00:09Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2021-05-30T14:30:15Z</InitialReleaseDate>
    <CurrentReleaseDate>2025-02-17T02:00:09Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf-cve.pl</Engine>
      <Date>2020-12-27T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="CVE" Type="Summary" Ordinal="1" xml:lang="en">CVE-2019-14299</Note>
    <Note Title="Mitre CVE Description" Type="Description" Ordinal="2" xml:lang="en">Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks. Some Ricoh printers did not implement account lockout. Therefore, it was possible to obtain the local account credentials by brute force.</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="4" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
  </DocumentNotes>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2020-November/007831.html</URL>
      <Description>E-Mail link for SUSE-SU-2020:3474-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Enterprise Storage 5">
      <Branch Type="Product Name" Name="SUSE Enterprise Storage 5">
        <FullProductName ProductID="SUSE Enterprise Storage 5" CPE="cpe:/o:suse:ses:5">SUSE Enterprise Storage 5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP3-ESPOS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP3-ESPOS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP3-ESPOS" CPE="cpe:/o:suse:sles-espos:12:sp3">SUSE Linux Enterprise Server 12 SP3-ESPOS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP3-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP3-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP3-LTSS" CPE="cpe:/o:suse:sles-ltss:12:sp3">SUSE Linux Enterprise Server 12 SP3-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="u-boot-rpi3-2016.07-12.3.1">
      <FullProductName ProductID="u-boot-rpi3-2016.07-12.3.1" CPE="cpe:2.3:a:denx:u-boot:2016.07:*:*:*:*:*:*:*">u-boot-rpi3-2016.07-12.3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="u-boot-tools-2016.07-12.3.1">
      <FullProductName ProductID="u-boot-tools-2016.07-12.3.1">u-boot-tools-2016.07-12.3.1</FullProductName>
    </Branch>
    <Relationship ProductReference="u-boot-rpi3-2016.07-12.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 5">
      <FullProductName ProductID="SUSE Enterprise Storage 5:u-boot-rpi3-2016.07-12.3.1">u-boot-rpi3-2016.07-12.3.1 as a component of SUSE Enterprise Storage 5</FullProductName>
    </Relationship>
    <Relationship ProductReference="u-boot-tools-2016.07-12.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 5">
      <FullProductName ProductID="SUSE Enterprise Storage 5:u-boot-tools-2016.07-12.3.1">u-boot-tools-2016.07-12.3.1 as a component of SUSE Enterprise Storage 5</FullProductName>
    </Relationship>
    <Relationship ProductReference="u-boot-rpi3-2016.07-12.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP3-ESPOS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP3-ESPOS:u-boot-rpi3-2016.07-12.3.1">u-boot-rpi3-2016.07-12.3.1 as a component of SUSE Linux Enterprise Server 12 SP3-ESPOS</FullProductName>
    </Relationship>
    <Relationship ProductReference="u-boot-tools-2016.07-12.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP3-ESPOS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP3-ESPOS:u-boot-tools-2016.07-12.3.1">u-boot-tools-2016.07-12.3.1 as a component of SUSE Linux Enterprise Server 12 SP3-ESPOS</FullProductName>
    </Relationship>
    <Relationship ProductReference="u-boot-rpi3-2016.07-12.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP3-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP3-LTSS:u-boot-rpi3-2016.07-12.3.1">u-boot-rpi3-2016.07-12.3.1 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="u-boot-tools-2016.07-12.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP3-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP3-LTSS:u-boot-tools-2016.07-12.3.1">u-boot-tools-2016.07-12.3.1 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS</FullProductName>
    </Relationship>
  </ProductTree>
  <Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks. Some Ricoh printers did not implement account lockout. Therefore, it was possible to obtain the local account credentials by brute force.</Note>
    </Notes>
    <CVE>CVE-2019-14299</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 5:u-boot-rpi3-2016.07-12.3.1</ProductID>
        <ProductID>SUSE Enterprise Storage 5:u-boot-tools-2016.07-12.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-ESPOS:u-boot-rpi3-2016.07-12.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-ESPOS:u-boot-tools-2016.07-12.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-LTSS:u-boot-rpi3-2016.07-12.3.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP3-LTSS:u-boot-tools-2016.07-12.3.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>9.8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
  </Vulnerability>
</cvrfdoc>
