PT-2023-14620 · Suse · Suse Linux Enterprise Server 15 Sp3+4

Marcus Meissner + 1 · Published 2023-02-15 · Updated 2024-06-15 · CVE-2022-45154

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise Server 12 supportutils versions 3.0.10-95.51.1 and prior versions SUSE Linux Enterprise Server 15 supportutils versions 3.1.21-150000.5.44.1 and prior versions SUSE Linux Enterprise Server 15 SP3 supportutils versions 3.1.21-150300.7.35.15.1 and prior versions

Description A Cleartext Storage of Sensitive Information issue in supportutils of SUSE Linux Enterprise Server allows attackers that gain access to the support logs to obtain knowledge of the stored credentials.

Recommendations For SUSE Linux Enterprise Server 12 supportutils versions 3.0.10-95.51.1 and prior versions, update to a version later than 3.0.10-95.51.1 to resolve the issue. For SUSE Linux Enterprise Server 15 supportutils versions 3.1.21-150000.5.44.1 and prior versions, update to a version later than 3.1.21-150000.5.44.1 to resolve the issue. For SUSE Linux Enterprise Server 15 SP3 supportutils versions 3.1.21-150300.7.35.15.1 and prior versions, update to a version later than 3.1.21-150300.7.35.15.1 to resolve the issue.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2022-45154

OPENSUSE-SU-2023_3822-1

OPENSUSE-SU-2024:12970-1

SUSE-SU-2023:2465-1

SUSE-SU-2023:3803-1

SUSE-SU-2023:3822-1

SUSE-SU-2023:3822-2

SUSE-SU-2023_2465-1

SUSE-SU-2023_3803-1

SUSE-SU-2023_3822-1

Affected Products

Suse Linux Enterprise Server 12

Suse Linux Enterprise Server 15

Suse Linux Enterprise Server 15 Sp3

Suse

Supportutils

References · 30

• 🔥 https://bugzilla.suse.com/show_bug.cgi?id=1207598 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-45154 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:3822-2 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:3803-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:2465-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:3822-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45154 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12970-1 · Vendor Advisory
• https://bugzilla.suse.com/1210950 · Note
• https://bugzilla.suse.com/1210015 · Note
• https://suse.com/support/update/announcement/2023/suse-su-20233803-1 · Note
• https://suse.com/support/update/announcement/2023/suse-su-20232465-1 · Note
• https://bugzilla.suse.com/1211599 · Note
• https://suse.com/support/update/announcement/2023/suse-su-20233822-1 · Note
• https://bugzilla.suse.com/1207543 · Note