Vulnerability-Lookup

SUSE-EL-9-CLIENT-TOOLS-2025-532

Vulnerability from csaf_suse - Published: 2025-02-14 07:20 - Updated: 2026-09-20 11:57

Summary

Security update for SUSE Manager Client Tools

Severity

Moderate

Notes

Title of the patch: Security update for SUSE Manager Client Tools

Description of the patch: This update fixes the following issues: scap-security-guide was updated to version 0.1.75 (jsc#ECO-3319): - Added Ism profile for OL8, OL9 - Added new product kylinserver10 - Created OL10 product - Release SLMicro5 product - Replaced two date injections by SOURCE_DATE_EPOCH to make reproducible (bsc#1230361) - Updated PCI-DSS control file for version 4.0.1 spacecmd was updated to version 5.0.11-0: - Updated translation strings uyuni-tools was updated from version 0.1.23-0 to 0.1.27-0: - Security issues fixed: * CVE-2024-22037: Use podman secret to store the database credentials (bsc#1231497) - Other changes and bugs fixed: * Version 0.1.27-0 + Bump the default image tag to 5.0.3 + IsInstalled function fix + Run systemctl daemon-reload after changing the container image config (bsc#1233279) + Coco-replicas-upgrade + Persist search server indexes (bsc#1231759) + Sync deletes files during migration (bsc#1233660) + Ignore coco and hub images when applying PTF if they are not ailable (bsc#1229079) + Add --registry back to mgrpxy (bsc#1233202) + Only add java.hostname on migrated server if not present + Consider the configuration file to detect the coco or hub api images should be pulled (bsc#1229104) + Only raise an error if cloudguestregistryauth fails for PAYG (bsc#1233630) + Add registry.suse.com login to mgradm upgrade podman list (bsc#1234123) * Version 0.1.26-0 + Ignore all zypper caches during migration (bsc#1232769) + Use the uyuni network for all podman containers (bsc#1232817) * Version 0.1.25-0 + Don't migrate enabled systemd services, recreate them (bsc#1232575) * Version 0.1.24-0 + Redact JSESSIONID and pxt-session-cookie values from logs and console output (bsc#1231568)

Patchnames: SUSE-EL-9-CLIENT-TOOLS-2025-532

CVE-2024-22037

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-bash-completion-0:0.1.28-1.14.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-zsh-completion-0:0.1.28-1.14.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:scap-security-guide-redhat-0:0.1.75-1.32.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:spacecmd-0:5.0.11-1.44.1.noarch	—	Vendor Fix

Threats

Impact moderate

References

19 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://bugzilla.suse.com/1229079	self
https://bugzilla.suse.com/1229104	self
https://bugzilla.suse.com/1230361	self
https://bugzilla.suse.com/1231497	self
https://bugzilla.suse.com/1231568	self
https://bugzilla.suse.com/1231759	self
https://bugzilla.suse.com/1232575	self
https://bugzilla.suse.com/1232769	self
https://bugzilla.suse.com/1232817	self
https://bugzilla.suse.com/1233202	self
https://bugzilla.suse.com/1233279	self
https://bugzilla.suse.com/1233630	self
https://bugzilla.suse.com/1233660	self
https://bugzilla.suse.com/1234123	self
https://www.suse.com/security/cve/CVE-2024-22037/	self
https://www.suse.com/security/cve/CVE-2024-22037	external
https://bugzilla.suse.com/1231497	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for SUSE Manager Client Tools",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update fixes the following issues:\n\nscap-security-guide was updated to version 0.1.75 (jsc#ECO-3319):\n\n- Added Ism profile for OL8, OL9\n- Added new product kylinserver10 \n- Created OL10 product \n- Release SLMicro5 product\n- Replaced two date injections by SOURCE_DATE_EPOCH to make reproducible (bsc#1230361)\n- Updated PCI-DSS control file for version 4.0.1\n\nspacecmd was updated to version 5.0.11-0:\n\n- Updated translation strings\n\nuyuni-tools was updated from version 0.1.23-0 to 0.1.27-0:\n\n- Security issues fixed:\n  * CVE-2024-22037: Use podman secret to store the database credentials (bsc#1231497)\n- Other changes and bugs fixed:\n  * Version 0.1.27-0\n    + Bump the default image tag to 5.0.3\n    + IsInstalled function fix\n    + Run systemctl daemon-reload after changing the container image config (bsc#1233279)\n    + Coco-replicas-upgrade\n    + Persist search server indexes (bsc#1231759)\n    + Sync deletes files during migration (bsc#1233660)\n    + Ignore coco and hub images when applying PTF if they are not ailable (bsc#1229079)\n    + Add --registry back to mgrpxy (bsc#1233202)\n    + Only add java.hostname on migrated server if not present\n    + Consider the configuration file to detect the coco or hub api images should be pulled (bsc#1229104)\n    + Only raise an error if cloudguestregistryauth fails for PAYG (bsc#1233630)\n    + Add registry.suse.com login to mgradm upgrade podman list (bsc#1234123)\n  * Version 0.1.26-0\n    + Ignore all zypper caches during migration (bsc#1232769)\n    + Use the uyuni network for all podman containers (bsc#1232817)\n  * Version 0.1.25-0\n    + Don\u0027t migrate enabled systemd services, recreate them (bsc#1232575)\n  * Version 0.1.24-0\n    + Redact JSESSIONID and pxt-session-cookie values from logs and\n      console output (bsc#1231568)\n\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-EL-9-CLIENT-TOOLS-2025-532",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-el-9-client-tools-2025-532.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1229079",
        "url": "https://bugzilla.suse.com/1229079"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1229104",
        "url": "https://bugzilla.suse.com/1229104"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1230361",
        "url": "https://bugzilla.suse.com/1230361"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1231497",
        "url": "https://bugzilla.suse.com/1231497"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1231568",
        "url": "https://bugzilla.suse.com/1231568"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1231759",
        "url": "https://bugzilla.suse.com/1231759"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1232575",
        "url": "https://bugzilla.suse.com/1232575"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1232769",
        "url": "https://bugzilla.suse.com/1232769"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1232817",
        "url": "https://bugzilla.suse.com/1232817"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1233202",
        "url": "https://bugzilla.suse.com/1233202"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1233279",
        "url": "https://bugzilla.suse.com/1233279"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1233630",
        "url": "https://bugzilla.suse.com/1233630"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1233660",
        "url": "https://bugzilla.suse.com/1233660"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1234123",
        "url": "https://bugzilla.suse.com/1234123"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-22037 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-22037/"
      }
    ],
    "title": "Security update for SUSE Manager Client Tools",
    "tracking": {
      "current_release_date": "2026-09-20T11:57:10Z",
      "generator": {
        "date": "2025-02-14T07:20:12Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-EL-9-CLIENT-TOOLS-2025-532",
      "initial_release_date": "2025-02-14T07:20:12Z",
      "revision_history": [
        {
          "date": "2025-02-14T07:20:12Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-15T08:44:55Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-20T11:57:10Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mgrctl-0:0.1.28-1.14.1.aarch64",
                "product": {
                  "name": "mgrctl-0:0.1.28-1.14.1.aarch64",
                  "product_id": "mgrctl-0:0.1.28-1.14.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mgrctl@0.1.28-1.14.1?arch=aarch64\u0026upstream=uyuni-tools-0:0.1.28-1.14.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mgrctl-bash-completion-0:0.1.28-1.14.1.noarch",
                "product": {
                  "name": "mgrctl-bash-completion-0:0.1.28-1.14.1.noarch",
                  "product_id": "mgrctl-bash-completion-0:0.1.28-1.14.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mgrctl-bash-completion@0.1.28-1.14.1?arch=noarch\u0026upstream=uyuni-tools-0:0.1.28-1.14.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mgrctl-zsh-completion-0:0.1.28-1.14.1.noarch",
                "product": {
                  "name": "mgrctl-zsh-completion-0:0.1.28-1.14.1.noarch",
                  "product_id": "mgrctl-zsh-completion-0:0.1.28-1.14.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mgrctl-zsh-completion@0.1.28-1.14.1?arch=noarch\u0026upstream=uyuni-tools-0:0.1.28-1.14.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "scap-security-guide-redhat-0:0.1.75-1.32.1.noarch",
                "product": {
                  "name": "scap-security-guide-redhat-0:0.1.75-1.32.1.noarch",
                  "product_id": "scap-security-guide-redhat-0:0.1.75-1.32.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/scap-security-guide-redhat@0.1.75-1.32.1?arch=noarch\u0026upstream=scap-security-guide-0:0.1.75-1.32.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "spacecmd-0:5.0.11-1.44.1.noarch",
                "product": {
                  "name": "spacecmd-0:5.0.11-1.44.1.noarch",
                  "product_id": "spacecmd-0:5.0.11-1.44.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/spacecmd@5.0.11-1.44.1?arch=noarch\u0026upstream=spacecmd-0:5.0.11-1.44.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mgrctl-0:0.1.28-1.14.1.ppc64le",
                "product": {
                  "name": "mgrctl-0:0.1.28-1.14.1.ppc64le",
                  "product_id": "mgrctl-0:0.1.28-1.14.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mgrctl@0.1.28-1.14.1?arch=ppc64le\u0026upstream=uyuni-tools-0:0.1.28-1.14.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mgrctl-0:0.1.28-1.14.1.s390x",
                "product": {
                  "name": "mgrctl-0:0.1.28-1.14.1.s390x",
                  "product_id": "mgrctl-0:0.1.28-1.14.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mgrctl@0.1.28-1.14.1?arch=s390x\u0026upstream=uyuni-tools-0:0.1.28-1.14.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mgrctl-0:0.1.28-1.14.1.x86_64",
                "product": {
                  "name": "mgrctl-0:0.1.28-1.14.1.x86_64",
                  "product_id": "mgrctl-0:0.1.28-1.14.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mgrctl@0.1.28-1.14.1?arch=x86_64\u0026upstream=uyuni-tools-0:0.1.28-1.14.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS",
                "product": {
                  "name": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS",
                  "product_id": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mgrctl-0:0.1.28-1.14.1.aarch64 as component of SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS",
          "product_id": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.aarch64"
        },
        "product_reference": "mgrctl-0:0.1.28-1.14.1.aarch64",
        "relates_to_product_reference": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mgrctl-0:0.1.28-1.14.1.ppc64le as component of SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS",
          "product_id": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.ppc64le"
        },
        "product_reference": "mgrctl-0:0.1.28-1.14.1.ppc64le",
        "relates_to_product_reference": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mgrctl-0:0.1.28-1.14.1.s390x as component of SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS",
          "product_id": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.s390x"
        },
        "product_reference": "mgrctl-0:0.1.28-1.14.1.s390x",
        "relates_to_product_reference": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mgrctl-0:0.1.28-1.14.1.x86_64 as component of SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS",
          "product_id": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.x86_64"
        },
        "product_reference": "mgrctl-0:0.1.28-1.14.1.x86_64",
        "relates_to_product_reference": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mgrctl-bash-completion-0:0.1.28-1.14.1.noarch as component of SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS",
          "product_id": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-bash-completion-0:0.1.28-1.14.1.noarch"
        },
        "product_reference": "mgrctl-bash-completion-0:0.1.28-1.14.1.noarch",
        "relates_to_product_reference": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mgrctl-zsh-completion-0:0.1.28-1.14.1.noarch as component of SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS",
          "product_id": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-zsh-completion-0:0.1.28-1.14.1.noarch"
        },
        "product_reference": "mgrctl-zsh-completion-0:0.1.28-1.14.1.noarch",
        "relates_to_product_reference": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "scap-security-guide-redhat-0:0.1.75-1.32.1.noarch as component of SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS",
          "product_id": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:scap-security-guide-redhat-0:0.1.75-1.32.1.noarch"
        },
        "product_reference": "scap-security-guide-redhat-0:0.1.75-1.32.1.noarch",
        "relates_to_product_reference": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "spacecmd-0:5.0.11-1.44.1.noarch as component of SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS",
          "product_id": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:spacecmd-0:5.0.11-1.44.1.noarch"
        },
        "product_reference": "spacecmd-0:5.0.11-1.44.1.noarch",
        "relates_to_product_reference": "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-22037",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-22037"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the environment is still exposed by systemd to non-privileged users.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.aarch64",
          "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.ppc64le",
          "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.s390x",
          "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.x86_64",
          "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-bash-completion-0:0.1.28-1.14.1.noarch",
          "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-zsh-completion-0:0.1.28-1.14.1.noarch",
          "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:scap-security-guide-redhat-0:0.1.75-1.32.1.noarch",
          "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:spacecmd-0:5.0.11-1.44.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-22037",
          "url": "https://www.suse.com/security/cve/CVE-2024-22037"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1231497 for CVE-2024-22037",
          "url": "https://bugzilla.suse.com/1231497"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.aarch64",
            "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.ppc64le",
            "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.s390x",
            "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.x86_64",
            "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-bash-completion-0:0.1.28-1.14.1.noarch",
            "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-zsh-completion-0:0.1.28-1.14.1.noarch",
            "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:scap-security-guide-redhat-0:0.1.75-1.32.1.noarch",
            "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:spacecmd-0:5.0.11-1.44.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.aarch64",
            "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.ppc64le",
            "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.s390x",
            "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-0:0.1.28-1.14.1.x86_64",
            "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-bash-completion-0:0.1.28-1.14.1.noarch",
            "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:mgrctl-zsh-completion-0:0.1.28-1.14.1.noarch",
            "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:scap-security-guide-redhat-0:0.1.75-1.32.1.noarch",
            "SUSE Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS:spacecmd-0:5.0.11-1.44.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-02-14T07:20:12Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-22037"
    }
  ]
}

CVE-2024-22037 (GCVE-0-2024-22037)

Vulnerability from cvelistv5 – Published: 2024-11-28 09:46 – Updated: 2024-11-28 12:15

Title

Database password leaked by systemd uyuni-server-attestation service

Summary

The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the environment is still exposed by systemd to non-privileged users.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5.7 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-28 12:09 UTC

CWE

CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

Assigner

suse CNA under the mitre root

CNA scorecard B 80/100 over 122 records in the last 180 days details

References

1 reference

URL	Tags
https://bugzilla.suse.com/show_bug.cgi?id=CVE-202…

Impacted products

1 product

Vendor	Product	Version
SUSE	SUSE Manager Server 5.0	Affected: ? , < 0.1.26-150500.3.12.2 (custom)

Date Public

2024-11-18 13:13

Credits

Cédric Bosdonnat of SUSE

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22037",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-28T12:09:25.201908Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-28T12:15:16.583Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "mgradm",
          "product": "SUSE Manager Server 5.0",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "0.1.26-150500.3.12.2",
              "status": "affected",
              "version": "?",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "mgradm-bash-completion",
          "product": "SUSE Manager Server 5.0",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "0.1.26-150500.3.12.2",
              "status": "affected",
              "version": "?",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "mgradm-lang",
          "product": "SUSE Manager Server 5.0",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "0.1.26-150500.3.12.2",
              "status": "affected",
              "version": "?",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "mgradm-zsh-completion",
          "product": "SUSE Manager Server 5.0",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "0.1.26-150500.3.12.2",
              "status": "affected",
              "version": "?",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "C\u00e9dric Bosdonnat of SUSE"
        }
      ],
      "datePublic": "2024-11-18T13:13:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the environment is still exposed by systemd to non-privileged users.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the environment is still exposed by systemd to non-privileged users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-497",
              "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-28T09:46:07.525Z",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22037"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Database password leaked by systemd uyuni-server-attestation service",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2024-22037",
    "datePublished": "2024-11-28T09:46:07.525Z",
    "dateReserved": "2024-01-04T12:38:34.025Z",
    "dateUpdated": "2024-11-28T12:15:16.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted