Inclusion of Sensitive Information in Log Files in SUSE Manager - CVE-2023-22644

Vulnerability identifier: #VU84791

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-22644

CWE-ID: CWE-532

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files. A local user can read the log files and gain access to sensitive data.

SUSE Manager
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server Module
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy Module
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Development Tools Module
Public Cloud Module
openSUSE Leap
inter-server-sync-debuginfo
inter-server-sync
subscription-matcher
virtual-host-gatherer-libcloud
virtual-host-gatherer-VMware
virtual-host-gatherer-Nutanix
virtual-host-gatherer
virtual-host-gatherer-Kubernetes
jsr-305-javadoc
jsr-305
cobbler
susemanager-tftpsync
supportutils-plugin-susemanager
mgr-libmod
python3-uyuni-common-libs
spacewalk-search
mgr-daemon
release-notes-susemanager-proxy
release-notes-susemanager
spacewalk-proxy-broker
spacewalk-proxy-common
spacewalk-proxy-package-manager
spacewalk-proxy-redirect
spacewalk-proxy-management
spacewalk-proxy-salt
spacecmd
spacewalk-client-tools
spacewalk-client-setup
python3-spacewalk-client-tools
spacewalk-check
python3-spacewalk-check
python3-spacewalk-client-setup
spacewalk-backend-sql-postgresql
spacewalk-backend
spacewalk-backend-package-push-server
spacewalk-backend-xmlrpc
spacewalk-backend-app
spacewalk-backend-iss-export
spacewalk-backend-applet
spacewalk-backend-config-files-common
spacewalk-backend-server
spacewalk-backend-config-files-tool
spacewalk-backend-sql
spacewalk-backend-config-files
spacewalk-backend-tools
spacewalk-backend-iss
spacewalk-backend-xml-export-libs
uyuni-config-modules
susemanager-sls
spacewalk-base-minimal
spacewalk-html
spacewalk-base-minimal-config
spacewalk-base
spacewalk-java-lib
spacewalk-java
spacewalk-java-postgresql
spacewalk-java-config
spacewalk-taskomatic
susemanager-docs_en-pdf
susemanager-docs_en
susemanager-doc-indexes
billing-data-service
uyuni-reportdb-schema
susemanager-tftpsync-recv
susemanager-sync-data
susemanager-schema
susemanager-schema-utility
susemanager-tools
susemanager
apache2-mod_wsgi
apache2-mod_wsgi-debuginfo
apache2-mod_wsgi-debugsource
susemanager-build-keys
susemanager-build-keys-web
guava

Install updates from vendor's website.

SUSE Manager - update to 4.3.10
inter-server-sync-debuginfo - update to 0.3.1-150400.3.24.5
inter-server-sync - update to 0.3.1-150400.3.24.5
subscription-matcher - addressed in versions 0.29-150300.6.15.5, 0.33-150400.3.16.3
virtual-host-gatherer-libcloud - update to 1.0.25-150300.3.12.5
virtual-host-gatherer-VMware - update to 1.0.25-150300.3.12.5
virtual-host-gatherer-Nutanix - update to 1.0.25-150300.3.12.5
virtual-host-gatherer - update to 1.0.25-150300.3.12.5
virtual-host-gatherer-Kubernetes - update to 1.0.25-150300.3.12.5
jsr-305-javadoc - update to 3.0.2-150200.3.7.5
jsr-305 - update to 3.0.2-150200.3.7.5
cobbler - update to 3.1.2-150300.5.22.5
susemanager-tftpsync - update to 4.2.4-150300.3.6.6
supportutils-plugin-susemanager - update to 4.2.6-150300.3.12.5
mgr-libmod - update to 4.2.8-150300.3.9.6
python3-uyuni-common-libs - update to 4.2.10-150300.3.17.6
spacewalk-search - addressed in versions 4.2.10-150300.3.18.6, 4.3.10-150400.3.15.4
mgr-daemon - update to 4.2.11-150300.2.12.5
release-notes-susemanager-proxy - addressed in versions 4.2.13-150300.3.64.2, 4.3.10-150400.3.72.1
release-notes-susemanager - addressed in versions 4.2.13-150300.3.81.1, 4.3.10-150400.3.93.1
spacewalk-proxy-broker - addressed in versions 4.2.14-150300.3.27.6, 4.3.17-150400.3.23.5
spacewalk-proxy-common - addressed in versions 4.2.14-150300.3.27.6, 4.3.17-150400.3.23.5
spacewalk-proxy-package-manager - addressed in versions 4.2.14-150300.3.27.6, 4.3.17-150400.3.23.5
spacewalk-proxy-redirect - addressed in versions 4.2.14-150300.3.27.6, 4.3.17-150400.3.23.5
spacewalk-proxy-management - addressed in versions 4.2.14-150300.3.27.6, 4.3.17-150400.3.23.5
spacewalk-proxy-salt - addressed in versions 4.2.14-150300.3.27.6, 4.3.17-150400.3.23.5
spacecmd - addressed in versions 4.2.22-150300.4.36.7, 4.3.25-150400.3.30.5
spacewalk-client-tools - addressed in versions 4.2.23-150300.4.33.7, 4.3.17-150400.3.21.6
spacewalk-client-setup - addressed in versions 4.2.23-150300.4.33.7, 4.3.17-150400.3.21.6
python3-spacewalk-client-tools - addressed in versions 4.2.23-150300.4.33.7, 4.3.17-150400.3.21.6
spacewalk-check - addressed in versions 4.2.23-150300.4.33.7, 4.3.17-150400.3.21.6
python3-spacewalk-check - addressed in versions 4.2.23-150300.4.33.7, 4.3.17-150400.3.21.6
python3-spacewalk-client-setup - addressed in versions 4.2.23-150300.4.33.7, 4.3.17-150400.3.21.6
spacewalk-backend-sql-postgresql - addressed in versions 4.2.27-150300.4.38.7, 4.3.25-150400.3.33.7
spacewalk-backend - addressed in versions 4.2.27-150300.4.38.7, 4.3.25-150400.3.33.7
spacewalk-backend-package-push-server - addressed in versions 4.2.27-150300.4.38.7, 4.3.25-150400.3.33.7
spacewalk-backend-xmlrpc - addressed in versions 4.2.27-150300.4.38.7, 4.3.25-150400.3.33.7
spacewalk-backend-app - addressed in versions 4.2.27-150300.4.38.7, 4.3.25-150400.3.33.7
spacewalk-backend-iss-export - addressed in versions 4.2.27-150300.4.38.7, 4.3.25-150400.3.33.7
spacewalk-backend-applet - addressed in versions 4.2.27-150300.4.38.7, 4.3.25-150400.3.33.7
spacewalk-backend-config-files-common - addressed in versions 4.2.27-150300.4.38.7, 4.3.25-150400.3.33.7
spacewalk-backend-server - addressed in versions 4.2.27-150300.4.38.7, 4.3.25-150400.3.33.7
spacewalk-backend-config-files-tool - addressed in versions 4.2.27-150300.4.38.7, 4.3.25-150400.3.33.7
spacewalk-backend-sql - addressed in versions 4.2.27-150300.4.38.7, 4.3.25-150400.3.33.7
spacewalk-backend-config-files - addressed in versions 4.2.27-150300.4.38.7, 4.3.25-150400.3.33.7
spacewalk-backend-tools - addressed in versions 4.2.27-150300.4.38.7, 4.3.25-150400.3.33.7
spacewalk-backend-iss - addressed in versions 4.2.27-150300.4.38.7, 4.3.25-150400.3.33.7
spacewalk-backend-xml-export-libs - addressed in versions 4.2.27-150300.4.38.7, 4.3.25-150400.3.33.7
uyuni-config-modules - addressed in versions 4.2.32-150300.3.46.5, 4.3.37-150400.3.37.5
susemanager-sls - addressed in versions 4.2.32-150300.3.46.5, 4.3.37-150400.3.37.5
spacewalk-base-minimal - addressed in versions 4.2.34-150300.3.41.5, 4.3.36-150400.3.36.7
spacewalk-html - addressed in versions 4.2.34-150300.3.41.5, 4.3.36-150400.3.36.7
spacewalk-base-minimal-config - addressed in versions 4.2.34-150300.3.41.5, 4.3.36-150400.3.36.7
spacewalk-base - addressed in versions 4.2.34-150300.3.41.5, 4.3.36-150400.3.36.7
spacewalk-java-lib - addressed in versions 4.2.49-150300.3.63.3, 4.3.69-150400.3.69.5
spacewalk-java - addressed in versions 4.2.49-150300.3.63.3, 4.3.69-150400.3.69.5
spacewalk-java-postgresql - addressed in versions 4.2.49-150300.3.63.3, 4.3.69-150400.3.69.5
spacewalk-java-config - addressed in versions 4.2.49-150300.3.63.3, 4.3.69-150400.3.69.5
spacewalk-taskomatic - addressed in versions 4.2.49-150300.3.63.3, 4.3.69-150400.3.69.5
susemanager-docs_en-pdf - addressed in versions 4.2-150300.12.42.5, 4.3-150400.9.50.5
susemanager-docs_en - addressed in versions 4.2-150300.12.42.5, 4.3-150400.9.50.5
susemanager-doc-indexes - update to 4.2-150300.12.42.6
billing-data-service - update to 4.3.2-150400.10.12.5
uyuni-reportdb-schema - update to 4.3.8-150400.3.9.6
susemanager-tftpsync-recv - update to 4.3.9-150400.3.9.5
susemanager-sync-data - update to 4.3.14-150400.3.17.5
susemanager-schema - update to 4.3.22-150400.3.30.5
susemanager-schema-utility - update to 4.3.22-150400.3.30.5
susemanager-tools - update to 4.3.33-150400.3.42.4
susemanager - update to 4.3.33-150400.3.42.4
apache2-mod_wsgi - update to 4.7.1-150400.3.9.4
apache2-mod_wsgi-debuginfo - update to 4.7.1-150400.3.9.4
apache2-mod_wsgi-debugsource - update to 4.7.1-150400.3.9.4
susemanager-build-keys - update to 15.3.6-150300.3.9.5
susemanager-build-keys-web - update to 15.3.6-150300.3.9.5
guava - update to 30.1.1-150300.4.3.4

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22644

• SUSE update for SUSE Manager 4.3.10 Release Notes
• SUSE update for Maintenance update for SUSE Manager 4.3: Server, Proxy and Retail Branch Server
• SUSE update for SUSE Manager Server 4.2
• SUSE update for Maintenance update for SUSE Manager 4.2: Server, Proxy and Retail Branch Server