Security update for supportutils SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:2465-1 Final 1 1 2023-06-08T07:43:26Z current 2023-06-08T07:43:26Z 2023-06-08T07:43:26Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for supportutils This update for supportutils fixes the following issues: Security fixes: - CVE-2022-45154: Removed iSCSI passwords from supportconfig archive (bsc#1207598). Bug fixes: - Fixed missing status detail for apparmor (bsc#1196933) - Corrected invalid argument list in docker.txt (bsc#1206608) - Changed _sanitize_file to include lio_setup.sh (bsc#1206350) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP5-Azure-BYOS-2023-2465,Image SLES12-SP5-Azure-Basic-On-Demand-2023-2465,Image SLES12-SP5-Azure-HPC-BYOS-2023-2465,Image SLES12-SP5-Azure-HPC-On-Demand-2023-2465,Image SLES12-SP5-Azure-SAP-BYOS-2023-2465,Image SLES12-SP5-Azure-SAP-On-Demand-2023-2465,Image SLES12-SP5-Azure-Standard-On-Demand-2023-2465,Image SLES12-SP5-EC2-BYOS-2023-2465,Image SLES12-SP5-EC2-ECS-On-Demand-2023-2465,Image SLES12-SP5-EC2-On-Demand-2023-2465,Image SLES12-SP5-EC2-SAP-BYOS-2023-2465,Image SLES12-SP5-EC2-SAP-On-Demand-2023-2465,Image SLES12-SP5-GCE-BYOS-2023-2465,Image SLES12-SP5-GCE-On-Demand-2023-2465,Image SLES12-SP5-GCE-SAP-BYOS-2023-2465,Image SLES12-SP5-GCE-SAP-On-Demand-2023-2465,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2023-2465,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2023-2465,SUSE-2023-2465,SUSE-SLE-SERVER-12-SP5-2023-2465 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20232465-1/ Link for SUSE-SU-2023:2465-1 https://lists.suse.com/pipermail/sle-updates/2023-June/029775.html E-Mail link for SUSE-SU-2023:2465-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1196933 SUSE Bug 1196933 https://bugzilla.suse.com/1206350 SUSE Bug 1206350 https://bugzilla.suse.com/1206608 SUSE Bug 1206608 https://bugzilla.suse.com/1207598 SUSE Bug 1207598 https://www.suse.com/security/cve/CVE-2022-45154/ SUSE CVE CVE-2022-45154 page Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-Basic-On-Demand Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 supportutils-3.0.11-95.54.1 supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-Azure-BYOS supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-EC2-BYOS supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-EC2-On-Demand supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-GCE-BYOS supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-GCE-On-Demand supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production supportutils-3.0.11-95.54.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production supportutils-3.0.11-95.54.1 as a component of SUSE Linux Enterprise Server 12 SP5 supportutils-3.0.11-95.54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions. CVE-2022-45154 Image SLES12-SP5-Azure-BYOS:supportutils-3.0.11-95.54.1 Image SLES12-SP5-Azure-Basic-On-Demand:supportutils-3.0.11-95.54.1 Image SLES12-SP5-Azure-HPC-BYOS:supportutils-3.0.11-95.54.1 Image SLES12-SP5-Azure-HPC-On-Demand:supportutils-3.0.11-95.54.1 Image SLES12-SP5-Azure-SAP-BYOS:supportutils-3.0.11-95.54.1 Image SLES12-SP5-Azure-SAP-On-Demand:supportutils-3.0.11-95.54.1 Image SLES12-SP5-Azure-Standard-On-Demand:supportutils-3.0.11-95.54.1 Image SLES12-SP5-EC2-BYOS:supportutils-3.0.11-95.54.1 Image SLES12-SP5-EC2-ECS-On-Demand:supportutils-3.0.11-95.54.1 Image SLES12-SP5-EC2-On-Demand:supportutils-3.0.11-95.54.1 Image SLES12-SP5-EC2-SAP-BYOS:supportutils-3.0.11-95.54.1 Image SLES12-SP5-EC2-SAP-On-Demand:supportutils-3.0.11-95.54.1 Image SLES12-SP5-GCE-BYOS:supportutils-3.0.11-95.54.1 Image SLES12-SP5-GCE-On-Demand:supportutils-3.0.11-95.54.1 Image SLES12-SP5-GCE-SAP-BYOS:supportutils-3.0.11-95.54.1 Image SLES12-SP5-GCE-SAP-On-Demand:supportutils-3.0.11-95.54.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:supportutils-3.0.11-95.54.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:supportutils-3.0.11-95.54.1 SUSE Linux Enterprise Server 12 SP5:supportutils-3.0.11-95.54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:supportutils-3.0.11-95.54.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232465-1/ https://www.suse.com/security/cve/CVE-2022-45154.html CVE-2022-45154 https://bugzilla.suse.com/1207598 SUSE Bug 1207598