Uyuni server attestation service exposed database password

CVE-2024-22037

Summary

The uyuni-server-attestation systemd service has a significant security flaw related to its database password configuration. Specifically, it relies on an environment variable that is not properly secured. The associated file has permissions set to 640, limiting access to privileged users. However, the environment variable is still visible to non-privileged users through the systemd service management, leading to potential credential exposure. Organizations utilizing the Uyuni Server are urged to review their security configurations to mitigate risks associated with this exposure.

References