CVE-2022-45154

supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh

4.4 MediumFix available

A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: Low

Exploit likelihood

0.17%Down 0.7 points since Feb 16, 2023

What each source reports

CVE List Score used 4.4

supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh

Record: CVE-2022-45154
CVSS 3.1: 4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Weakness: CWE-312
Updated: 2026-11-02

EUVDEUVD-2022-48063 4.4

Record: EUVD-2022-48063
CVSS 3.1: 4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-qrgp-9jwv-233w 5.5

A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux...

Record: GHSA-qrgp-9jwv-233w
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-312
Updated: 2026-11-02

NVD 4.4

Record: CVE-2022-45154
CVSS 3.1: 4.4 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-312
Updated: 2026-11-02

OSVopenSUSE-SU-2024:12970-1 No score

supportutils-3.1.25-1.1 on GA media

These are all security issues fixed in the supportutils-3.1.25-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:12970-1
Updated: 2026-11-02

OSVSUSE-SU-2023:2465-1 No score

Security update for supportutils

This update for supportutils fixes the following issues:

Security fixes:

CVE-2022-45154: Removed iSCSI passwords from supportconfig archive (bsc#1207598).

Bug fixes:

Fixed missing status detail for apparmor (bsc#1196933)
Corrected invalid argument list in docker.txt (bsc#1206608)
Changed _sanitize_file to include lio_setup.sh (bsc#1206350)

Record: SUSE-SU-2023:2465-1
Updated: 2026-11-02

OSVSUSE-SU-2023:3803-1 No score

Security update for supportutils

This update for supportutils fixes the following issues:

Security Fixes:

CVE-2022-45154: Removed iSCSI passwords (bsc#1207598).

Other fixes:

Changes in version 3.1.26
- powerpc plugin to collect the slots and active memory (bsc#1210950)
- A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154
- supportconfig: collect BPF information (pr#154)
- Added additional iscsi information (pr#155)
Added run time detection (bsc#1213127)
Changes for supportutils version 3.1.25
- Removed iSCSI passwords CVE-2022-45154 (bsc#1207598)
- powerpc: Collect lsslot,amsstat, and opal elogs (pr#149)
- powerpc: collect invscout logs (pr#150)
- powerpc: collect RMC status logs (pr#151)
- Added missing nvme nbft commands (bsc#1211599)
- Fixed invalid nvme commands (bsc#1211598)
- Added missing podman information (PED-1703, bsc#1181477)
- Removed dependency on sysfstools
- Check for systool use (bsc#1210015)
- Added selinux checking (bsc#1209979)
- Updated SLES_VER matrix
Fixed missing status detail for apparmor (bsc#1196933)
Corrected invalid argument list in docker.txt (bsc#1206608)
Applies limit equally to sar data and text files (bsc#1207543)
Collects hwinfo hardware logs (bsc#1208928)
Collects lparnumascore logs (issue#148)
Add dependency to numactl on ppc64le and s390x, this enforces that numactl --hardware data is provided in supportconfigs
Changes to supportconfig.rc version 3.1.11-35
- Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402)
Changes to supportconfig version 3.1.11-46.4
- Added plymouth_info
Changes to getappcore version 1.53.02
- The location of chkbin was updated earlier. This documents that change (bsc#1205533, bsc#1204942)

Record: SUSE-SU-2023:3803-1
Updated: 2026-11-02

OSVSUSE-SU-2023:3822-1 No score

Security update for supportutils

This update for supportutils fixes the following issues:

Security fixes:

CVE-2022-45154: Removed iSCSI passwords (bsc#1207598).

Other Fixes:

Changes in version 3.1.26
- powerpc plugin to collect the slots and active memory (bsc#1210950)
- A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154
- supportconfig: collect BPF information (pr#154)
- Added additional iscsi information (pr#155)
Added run time detection (bsc#1213127)
Changes for supportutils version 3.1.25
- Removed iSCSI passwords CVE-2022-45154 (bsc#1207598)
- powerpc: Collect lsslot,amsstat, and opal elogs (pr#149)
- powerpc: collect invscout logs (pr#150)
- powerpc: collect RMC status logs (pr#151)
- Added missing nvme nbft commands (bsc#1211599)
- Fixed invalid nvme commands (bsc#1211598)
- Added missing podman information (PED-1703, bsc#1181477)
- Removed dependency on sysfstools
- Check for systool use (bsc#1210015)
- Added selinux checking (bsc#1209979)
- Updated SLES_VER matrix
Fixed missing status detail for apparmor (bsc#1196933)
Corrected invalid argument list in docker.txt (bsc#1206608)
Applies limit equally to sar data and text files (bsc#1207543)
Collects hwinfo hardware logs (bsc#1208928)
Collects lparnumascore logs (issue#148)
Add dependency to numactl on ppc64le and s390x, this enforces that numactl --hardware data is provided in supportconfigs
Changes to supportconfig.rc version 3.1.11-35
- Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402)
Changes to supportconfig version 3.1.11-46.4
- Added plymouth_info
Changes to getappcore version 1.53.02
- The location of chkbin was updated earlier. This documents that change (bsc#1205533, bsc#1204942)

Record: SUSE-SU-2023:3822-1
Updated: 2026-11-02

OSVSUSE-SU-2023:3822-2 No score

Security update for supportutils

This update for supportutils fixes the following issues:

Security fixes:

CVE-2022-45154: Removed iSCSI passwords (bsc#1207598).

Other Fixes:

Changes in version 3.1.26
- powerpc plugin to collect the slots and active memory (bsc#1210950)
- A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154
- supportconfig: collect BPF information (pr#154)
- Added additional iscsi information (pr#155)
Added run time detection (bsc#1213127)
Changes for supportutils version 3.1.25
- Removed iSCSI passwords CVE-2022-45154 (bsc#1207598)
- powerpc: Collect lsslot,amsstat, and opal elogs (pr#149)
- powerpc: collect invscout logs (pr#150)
- powerpc: collect RMC status logs (pr#151)
- Added missing nvme nbft commands (bsc#1211599)
- Fixed invalid nvme commands (bsc#1211598)
- Added missing podman information (PED-1703, bsc#1181477)
- Removed dependency on sysfstools
- Check for systool use (bsc#1210015)
- Added selinux checking (bsc#1209979)
- Updated SLES_VER matrix
Fixed missing status detail for apparmor (bsc#1196933)
Corrected invalid argument list in docker.txt (bsc#1206608)
Applies limit equally to sar data and text files (bsc#1207543)
Collects hwinfo hardware logs (bsc#1208928)
Collects lparnumascore logs (issue#148)
Add dependency to numactl on ppc64le and s390x, this enforces that numactl --hardware data is provided in supportconfigs
Changes to supportconfig.rc version 3.1.11-35
- Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402)
Changes to supportconfig version 3.1.11-46.4
- Added plymouth_info
Changes to getappcore version 1.53.02
- The location of chkbin was updated earlier. This documents that change (bsc#1205533, bsc#1204942)

Record: SUSE-SU-2023:3822-2
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`supportutils` SUSE:Linux Enterprise Server 12 SP5	before 3.0.11-95.54.1	3.0.11-95.54.1
`supportutils` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	before 3.0.11-95.54.1	3.0.11-95.54.1
`supportutils` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS	before 3.1.26-150000.5.50.1	3.1.26-150000.5.50.1
`supportutils` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	before 3.1.26-150000.5.50.1	3.1.26-150000.5.50.1
`supportutils` SUSE:Linux Enterprise Server 15 SP1-LTSS	before 3.1.26-150000.5.50.1	3.1.26-150000.5.50.1
`supportutils` SUSE:Linux Enterprise Server 15 SP2-LTSS	before 3.1.26-150000.5.50.1	3.1.26-150000.5.50.1
`supportutils` SUSE:Linux Enterprise Server for SAP Applications 15 SP1	before 3.1.26-150000.5.50.1	3.1.26-150000.5.50.1
`supportutils` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	before 3.1.26-150000.5.50.1	3.1.26-150000.5.50.1
`supportutils` SUSE:Enterprise Storage 7	before 3.1.26-150000.5.50.1	3.1.26-150000.5.50.1
`supportutils` SUSE:Linux Enterprise Micro 5.3	before 3.1.26-150300.7.35.21.1	3.1.26-150300.7.35.21.1

Show 16 moreShow less

Affected packages
Package	Affected	Fixed
`supportutils` SUSE:Linux Enterprise Micro 5.4	before 3.1.26-150300.7.35.21.1	3.1.26-150300.7.35.21.1
`supportutils` SUSE:Linux Enterprise Module for Basesystem 15 SP4	before 3.1.26-150300.7.35.21.1	3.1.26-150300.7.35.21.1
`supportutils` SUSE:Linux Enterprise Module for Basesystem 15 SP5	before 3.1.26-150300.7.35.21.1	3.1.26-150300.7.35.21.1
`supportutils` SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS	before 3.1.26-150300.7.35.21.1	3.1.26-150300.7.35.21.1
`supportutils` SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS	before 3.1.26-150300.7.35.21.1	3.1.26-150300.7.35.21.1
`supportutils` SUSE:Linux Enterprise Server 15 SP3-LTSS	before 3.1.26-150300.7.35.21.1	3.1.26-150300.7.35.21.1
`supportutils` SUSE:Linux Enterprise Server for SAP Applications 15 SP3	before 3.1.26-150300.7.35.21.1	3.1.26-150300.7.35.21.1
`supportutils` SUSE:Manager Proxy 4.2	before 3.1.26-150300.7.35.21.1	3.1.26-150300.7.35.21.1
`supportutils` SUSE:Manager Server 4.2	before 3.1.26-150300.7.35.21.1	3.1.26-150300.7.35.21.1
`supportutils` SUSE:Linux Enterprise Micro 5.1	before 3.1.26-150300.7.35.21.1	3.1.26-150300.7.35.21.1
`supportutils` SUSE:Linux Enterprise Micro 5.2	before 3.1.26-150300.7.35.21.1	3.1.26-150300.7.35.21.1
`supportutils` SUSE:Enterprise Storage 7.1	before 3.1.26-150300.7.35.21.1	3.1.26-150300.7.35.21.1
`supportutils` openSUSE:Leap 15.4	before 3.1.26-150300.7.35.21.1	3.1.26-150300.7.35.21.1
`supportutils` openSUSE:Leap 15.5	before 3.1.26-150300.7.35.21.1	3.1.26-150300.7.35.21.1
`supportutils` SUSE:Linux Enterprise Micro 5.5	before 3.1.26-150300.7.35.21.1	3.1.26-150300.7.35.21.1
`supportutils` openSUSE:Tumbleweed	before 3.1.25-1.1	3.1.25-1.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-45154 is a medium vulnerability (CVSS 4.4) in Opensuse Supportutils, published February 15, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in supportutils 3.0.11-95.54.1.

References

Show 18 moreShow less