CVE-2024-22037 — Database password leaked by systemd uyuni-server-attestation service

CVE-2024-22037

Database password leaked by systemd uyuni-server-attestation service PUBLISHED

Description (CNA)

The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the environment is still exposed by systemd to non-privileged users.

Affected (CNA)

Vendor / product	Versions
SUSE / SUSE Manager Server 5.0	affected ? before 0.1.26-150500.3.12.2
SUSE / SUSE Manager Server 5.0	affected ? before 0.1.26-150500.3.12.2
SUSE / SUSE Manager Server 5.0	affected ? before 0.1.26-150500.3.12.2
SUSE / SUSE Manager Server 5.0	affected ? before 0.1.26-150500.3.12.2

CWE

CWE-497

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22037

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.