A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:3803-1 advisory.

    Security Fixes:

    - CVE-2022-45154: Removed iSCSI passwords (bsc#1207598).

    Other fixes:

    - Changes in version 3.1.26
      - powerpc plugin to collect the slots and active memory (bsc#1210950)
      - A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154
      - supportconfig: collect BPF information (pr#154)
      - Added additional iscsi information (pr#155)

    - Added run time detection (bsc#1213127)

    - Changes for supportutils version 3.1.25
      - Removed iSCSI passwords CVE-2022-45154 (bsc#1207598)
      - powerpc: Collect lsslot,amsstat, and opal elogs (pr#149)
      - powerpc: collect invscout logs (pr#150)
      - powerpc: collect RMC status logs (pr#151)
      - Added missing nvme nbft commands (bsc#1211599)
      - Fixed invalid nvme commands (bsc#1211598)
      - Added missing podman information (PED-1703, bsc#1181477)
      - Removed dependency on sysfstools
      - Check for systool use (bsc#1210015)
      - Added selinux checking (bsc#1209979)
      - Updated SLES_VER matrix

    - Fixed missing status detail for apparmor (bsc#1196933)
    - Corrected invalid argument list in docker.txt (bsc#1206608)
    - Applies limit equally to sar data and text files (bsc#1207543)
    - Collects hwinfo hardware logs (bsc#1208928)
    - Collects lparnumascore logs (issue#148)

    - Add dependency to `numactl` on ppc64le and `s390x`, this enforces       that `numactl --hardware` data is provided in supportconfigs

    - Changes to supportconfig.rc version 3.1.11-35
      - Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402)

    - Changes to supportconfig version 3.1.11-46.4
      - Added plymouth_info

    - Changes to getappcore version 1.53.02
      - The location of chkbin was updated earlier. This documents that         change (bsc#1205533, bsc#1204942)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:3822-1 advisory.

    Security fixes:

    - CVE-2022-45154: Removed iSCSI passwords (bsc#1207598).

    Other Fixes:

    - Changes in version 3.1.26
      - powerpc plugin to collect the slots and active memory (bsc#1210950)
      - A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154
      - supportconfig: collect BPF information (pr#154)
      - Added additional iscsi information (pr#155)

    - Added run time detection (bsc#1213127)

    - Changes for supportutils version 3.1.25
      - Removed iSCSI passwords CVE-2022-45154 (bsc#1207598)
      - powerpc: Collect lsslot,amsstat, and opal elogs (pr#149)
      - powerpc: collect invscout logs (pr#150)
      - powerpc: collect RMC status logs (pr#151)
      - Added missing nvme nbft commands (bsc#1211599)
      - Fixed invalid nvme commands (bsc#1211598)
      - Added missing podman information (PED-1703, bsc#1181477)
      - Removed dependency on sysfstools
      - Check for systool use (bsc#1210015)
      - Added selinux checking (bsc#1209979)
      - Updated SLES_VER matrix

    - Fixed missing status detail for apparmor (bsc#1196933)
    - Corrected invalid argument list in docker.txt (bsc#1206608)
    - Applies limit equally to sar data and text files (bsc#1207543)
    - Collects hwinfo hardware logs (bsc#1208928)
    - Collects lparnumascore logs (issue#148)

    - Add dependency to `numactl` on ppc64le and `s390x`, this enforces       that `numactl --hardware` data is provided in supportconfigs

    - Changes to supportconfig.rc version 3.1.11-35
      - Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402)

    - Changes to supportconfig version 3.1.11-46.4
      - Added plymouth_info

    - Changes to getappcore version 1.53.02
      - The location of chkbin was updated earlier. This documents that         change (bsc#1205533, bsc#1204942)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2465-1 advisory.

    Security fixes:

    - CVE-2022-45154: Removed iSCSI passwords from supportconfig archive (bsc#1207598).

    Bug fixes:

    - Fixed missing status detail for apparmor (bsc#1196933)
    - Corrected invalid argument list in docker.txt (bsc#1206608)
    - Changed _sanitize_file to include lio_setup.sh (bsc#1206350)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
182109	SUSE SLES15 Security Update : supportutils (SUSE-SU-2023:3803-1)	Nessus	SuSE Local Security Checks	Local	medium
182103	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : supportutils (SUSE-SU-2023:3822-1)	Nessus	SuSE Local Security Checks	Local	medium
177053	SUSE SLES12 Security Update : supportutils (SUSE-SU-2023:2465-1)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2022-45154

medium

Tenable Plugins

medium

medium

medium