PT-2024-19170 · Suse · Suse Manager Server+1

Cédric Bosdonnat · Published 2024-11-18 · Updated 2025-02-14 · CVE-2024-22037

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SUSE Manager Server (affected versions not specified)

Description The issue concerns the exposure of sensitive system information due to the uyuni-server-attestation systemd service needing a database password environment variable. Although the file containing this variable has 640 permission and cannot be directly shown to users, the environment is still exposed by systemd to non-privileged users, potentially leading to unauthorized access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2024-22037

OPENSUSE-SU-2025_0525-1

SUSE-RU-2024:4008-1

SUSE-SU-2025:0524-1

SUSE-SU-2025:0525-1

SUSE-SU-2025:0532-1

SUSE-SU-2025:20124-1

Affected Products

Suse Manager Server

Suse

References · 60

• https://osv.dev/vulnerability/SUSE-RU-2024:4008-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22037 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:0525-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0532-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0524-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:20124-1 · Vendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22037 · Note
• https://bugzilla.suse.com/1235145 · Note
• https://bugzilla.suse.com/1226759 · Note
• https://bugzilla.suse.com/1232769 · Note
• https://bugzilla.suse.com/1230136 · Note
• https://suse.com/security/cve/CVE-2024-22037 · Note
• https://bugzilla.suse.com/1230285 · Note
• https://suse.com/support/update/announcement/2025/suse-su-20250524-1 · Note
• https://bugzilla.suse.com/1236301 · Note