Information disclosure in Microsoft products - CVE-2022-30187

Vulnerability identifier: #VU65206

CSH Severity: Low

CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-30187

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Azure Storage Library. A local user can gain unauthorized access to sensitive information on the system.

Azure Storage Queues client library for Python
Azure Storage Queues client library for .NET
Azure Storage Blobs client library for Python
Azure Storage Blobs client library for Java
Azure Storage Blobs client library for .NET
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
Public Cloud Module
openSUSE Leap
IBM Disconnected Log Collector
python3-azure-core
python2-azure-core
python2-typing_extensions
python3-typing_extensions
python2-azure-storage-queue
python3-azure-storage-queue
python3-azure-storage-blob
python2-azure-storage-blob
IBM Workload Scheduler

Install updates from vendor's website.

IBM Disconnected Log Collector - update to 1.8.3
python3-azure-core - update to 1.23.1-150100.3.13.1
python2-azure-core - update to 1.23.1-150100.3.13.1
python2-typing_extensions - update to 3.10.0.0-150100.3.5.1
python3-typing_extensions - update to 3.10.0.0-150100.3.5.1
IBM Workload Scheduler - addressed in versions 9.5.0.7, 10.1.0.5, 10.2.2
python2-azure-storage-queue - update to 12.4.0-150100.3.7.1
python3-azure-storage-queue - update to 12.4.0-150100.3.7.1
python3-azure-storage-blob - update to 12.13.1-150100.3.10.1
python2-azure-storage-blob - update to 12.13.1-150100.3.10.1

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30187

• Information disclosure in Microsoft Azure Storage Library
• SUSE update for python-azure-storage-queue
• Multiple vulnerabilities in IBM Disconnected Log Collector
• SUSE update for python-azure-core, python-azure-storage-blob
• IBM Workload Scheduler update for Microsoft Azure Storage