supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh
CVE-2022-45154

4.4MEDIUM

Key Information:

Vendor
Suse
Status
Suse Linux Enterprise Server 12
Suse Linux Enterprise Server 15
Suse Linux Enterprise Server 15 Sp3
Vendor
CVE Published:
15 February 2023

Summary

A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions.

Affected Version(s)

SUSE Linux Enterprise Server 12 supportutils <= 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information

SUSE Linux Enterprise Server 15 supportutils <= 3.1.21-150000.5.44.1

SUSE Linux Enterprise Server 15 SP3 supportutils <= 3.1.21-150300.7.35.15.1

References

https://bugzilla.suse.com/show_bug.cgi?id=1207598

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nozomi Matsuzawa
.