CVE-2022-45154 — supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh

Description (CNA)

A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions.

Affected (CNA)

Vendor / product	Versions
SUSE / SUSE Linux Enterprise Server 12	affected supportutils through 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information
SUSE / SUSE Linux Enterprise Server 15	affected supportutils through 3.1.21-150000.5.44.1
SUSE / SUSE Linux Enterprise Server 15 SP3	affected supportutils through 3.1.21-150300.7.35.15.1

CWE

CWE-312

References

https://bugzilla.suse.com/show_bug.cgi?id=1207598

ADP enrichment

CVE

No English description supplied.

https://bugzilla.suse.com/show_bug.cgi?id=1207598

CISA-ADP

No English description supplied.

No references supplied.