Every CVE Search/ Get API key

CVE-2022-45153

saphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha_cluster.sls

7.0 HighFix available

An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created. This issue affects: SUSE Linux Enterprise Module for SAP Applications 15-SP1 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. SUSE Linux Enterprise Server for SAP 12-SP5 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. openSUSE Leap 15.4 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.22%Down 0.7 points since Feb 16, 2023
90%50%10%1%

What each source reports

CVE List Score used 7.0

saphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha_cluster.sls

An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created. This issue affects: SUSE Linux Enterprise Module for SAP Applications 15-SP1 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. SUSE Linux Enterprise Server for SAP 12-SP5 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. openSUSE Leap 15.4 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e.

Record
CVE-2022-45153
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-276
Updated
2026-11-02
EUVDEUVD-2022-48062 7.0

An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created. This issue affects: SUSE Linux Enterprise Module for SAP Applications 15-SP1 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. SUSE Linux Enterprise Server for SAP 12-SP5 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. openSUSE Leap 15.4 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e.

Record
EUVD-2022-48062
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-4g85-9mh4-6cw4 7.8

An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux...

An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created. This issue affects: SUSE Linux Enterprise Module for SAP Applications 15-SP1 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. SUSE Linux Enterprise Server for SAP 12-SP5 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. openSUSE Leap 15.4 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e.

Record
GHSA-4g85-9mh4-6cw4
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-276
Updated
2026-11-02
NVD 7.0

An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created. This issue affects: SUSE Linux Enterprise Module for SAP Applications 15-SP1 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. SUSE Linux Enterprise Server for SAP 12-SP5 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. openSUSE Leap 15.4 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e.

Record
CVE-2022-45153
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-276
Updated
2026-11-02
OSVSUSE-SU-2023:0009-1 No score

Security update for saphanabootstrap-formula

This update for saphanabootstrap-formula fixes the following issues:

  • Version bump 0.13.1

    • revert changes to spec file to re-enable SLES RPM builds
    • CVE-2022-45153: Fixed privilege escalation for arbitrary users in hana/ha_cluster.sls (bsc#1205990)

  • Version bump 0.13.0

    • pass sid to sudoers in a SLES12 compatible way
    • add location constraint to gcp_stonith

  • Version bump 0.12.1

    • moved templates dir into hana dir in repository to be gitfs compatible

  • Version bump 0.12.0

    • add SAPHanaSR takeover blocker

  • Version bump 0.11.0

    • use check_cmd instead of tmp sudoers file
    • make sudoers rules more secure
    • migrate sudoers to template file

  • Version bump 0.10.1

    • fix hook removal conditions
    • fix majority_maker code on case grain is empty

  • Version bump 0.10.0

    • allow to disable shared HANA basepath and rework add_hosts code (enables HANA scale-out on AWS)
    • do not edit global.ini directly (if not needed)

  • Version bump 0.9.1

    • fix majority_maker code on case grain is empty

  • Version bump 0.9.0

    • define vip_mechanism for every provider and reorder resources (same schema for all SAP related formulas)

  • Version bump 0.8.1

    • use multi-target Hook on HANA scale-out

  • Version bump 0.8.0

    • add HANA scale-out support
    • add idempotence to not affect a running HANA and cluster

  • Version bump 0.7.2

    • add native fencing for microsoft-azure

  • fixes a not working import of dbapi in SUSE/ha-sap-terraform-deployments#703

  • removes the installation and extraction of all hdbcli files in the /hana/shared/srHook directory

  • fixes execution order of srTakeover/srCostOptMemConfig hook

  • renames and updates hook srTakeover to srCostOptMemConfig

  • Changing exporter stickiness to => 0 and adjusting the colocation score from +inf to -inf and changing the colocation from Master to Slave. This change fix the impact of a failed exporter in regards to the HANA DB.

  • Document extra_parameters in pillar.example (bsc#1185643)

  • Change hanadb_exporter default timeout value to 30 seconds

  • Set correct stickiness for the azure-lb resource The azure-lb resource receives an stickiness=0 to not influence on transitions calculations as the HANA resources have more priority

Record
SUSE-SU-2023:0009-1
Updated
2026-11-02
OSVSUSE-SU-2023:0010-1 No score

Security update for saphanabootstrap-formula

This update for saphanabootstrap-formula fixes the following issues:

  • Version bump 0.13.1

    • revert changes to spec file to re-enable SLES RPM builds
    • CVE-2022-45153: Fixed privilege escalation for arbitrary users in hana/ha_cluster.sls (bsc#1205990)

  • Version bump 0.13.0

    • pass sid to sudoers in a SLES12 compatible way
    • add location constraint to gcp_stonith

  • Version bump 0.12.1

    • moved templates dir into hana dir in repository to be gitfs compatible

  • Version bump 0.12.0

    • add SAPHanaSR takeover blocker

  • Version bump 0.11.0

    • use check_cmd instead of tmp sudoers file
    • make sudoers rules more secure
    • migrate sudoers to template file

  • Version bump 0.10.1

    • fix hook removal conditions
    • fix majority_maker code on case grain is empty

  • Version bump 0.10.0

    • allow to disable shared HANA basepath and rework add_hosts code (enables HANA scale-out on AWS)
    • do not edit global.ini directly (if not needed)

  • Version bump 0.9.1

    • fix majority_maker code on case grain is empty

  • Version bump 0.9.0

    • define vip_mechanism for every provider and reorder resources (same schema for all SAP related formulas)

  • Version bump 0.8.1

    • use multi-target Hook on HANA scale-out

  • Version bump 0.8.0

    • add HANA scale-out support
    • add idempotence to not affect a running HANA and cluster

  • Version bump 0.7.2

    • add native fencing for microsoft-azure

  • fixes a not working import of dbapi in SUSE/ha-sap-terraform-deployments#703

  • removes the installation and extraction of all hdbcli files in the /hana/shared/srHook directory

  • fixes execution order of srTakeover/srCostOptMemConfig hook

  • renames and updates hook srTakeover to srCostOptMemConfig

  • Changing exporter stickiness to => 0 and adjusting the colocation score from +inf to -inf and changing the colocation from Master to Slave. This change fix the impact of a failed exporter in regards to the HANA DB.

  • Document extra_parameters in pillar.example (bsc#1185643)

  • Change hanadb_exporter default timeout value to 30 seconds

  • Set correct stickiness for the azure-lb resource The azure-lb resource receives an stickiness=0 to not influence on transitions calculations as the HANA resources have more priority

Record
SUSE-SU-2023:0010-1
Updated
2026-11-02
OSVSUSE-SU-2023:0011-1 No score

Security update for saphanabootstrap-formula

This update for saphanabootstrap-formula fixes the following issues:

  • Version bump 0.13.1

    • revert changes to spec file to re-enable SLES RPM builds
    • CVE-2022-45153: Fixed privilege escalation for arbitrary users in hana/ha_cluster.sls (bsc#1205990)

  • Version bump 0.13.0

    • pass sid to sudoers in a SLES12 compatible way
    • add location constraint to gcp_stonith

  • Version bump 0.12.1

    • moved templates dir into hana dir in repository to be gitfs compatible

  • Version bump 0.12.0

    • add SAPHanaSR takeover blocker

  • Version bump 0.11.0

    • use check_cmd instead of tmp sudoers file
    • make sudoers rules more secure
    • migrate sudoers to template file

  • Version bump 0.10.1

    • fix hook removal conditions
    • fix majority_maker code on case grain is empty

  • Version bump 0.10.0

    • allow to disable shared HANA basepath and rework add_hosts code (enables HANA scale-out on AWS)
    • do not edit global.ini directly (if not needed)

  • Version bump 0.9.1

    • fix majority_maker code on case grain is empty

  • Version bump 0.9.0

    • define vip_mechanism for every provider and reorder resources (same schema for all SAP related formulas)

  • Version bump 0.8.1

    • use multi-target Hook on HANA scale-out

  • Version bump 0.8.0

    • add HANA scale-out support
    • add idempotence to not affect a running HANA and cluster

  • Version bump 0.7.2

    • add native fencing for microsoft-azure

  • fixes a not working import of dbapi in SUSE/ha-sap-terraform-deployments#703

  • removes the installation and extraction of all hdbcli files in the /hana/shared/srHook directory

  • fixes execution order of srTakeover/srCostOptMemConfig hook

  • renames and updates hook srTakeover to srCostOptMemConfig

  • Changing exporter stickiness to => 0 and adjusting the colocation score from +inf to -inf and changing the colocation from Master to Slave. This change fix the impact of a failed exporter in regards to the HANA DB.

  • Document extra_parameters in pillar.example (bsc#1185643)

  • Change hanadb_exporter default timeout value to 30 seconds

  • Set correct stickiness for the azure-lb resource The azure-lb resource receives an stickiness=0 to not influence on transitions calculations as the HANA resources have more priority

Record
SUSE-SU-2023:0011-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
saphanabootstrap-formula
SUSE:Linux Enterprise Module for SAP Applications 15 SP2
 before 0.13.1+git.1667812208.4db963e-150200.3.15.1
0.13.1+git.1667812208.4db963e-150200.3.15.1
saphanabootstrap-formula
SUSE:Linux Enterprise Module for SAP Applications 15 SP3
 before 0.13.1+git.1667812208.4db963e-150200.3.15.1
0.13.1+git.1667812208.4db963e-150200.3.15.1
saphanabootstrap-formula
SUSE:Linux Enterprise Module for SAP Applications 15 SP4
 before 0.13.1+git.1667812208.4db963e-150200.3.15.1
0.13.1+git.1667812208.4db963e-150200.3.15.1
saphanabootstrap-formula
SUSE:Manager Server Module 4.2
 before 0.13.1+git.1667812208.4db963e-150200.3.15.1
0.13.1+git.1667812208.4db963e-150200.3.15.1
saphanabootstrap-formula
SUSE:Manager Server Module 4.3
 before 0.13.1+git.1667812208.4db963e-150200.3.15.1
0.13.1+git.1667812208.4db963e-150200.3.15.1
saphanabootstrap-formula
openSUSE:Leap 15.3
 before 0.13.1+git.1667812208.4db963e-150200.3.15.1
0.13.1+git.1667812208.4db963e-150200.3.15.1
saphanabootstrap-formula
openSUSE:Leap 15.4
 before 0.13.1+git.1667812208.4db963e-150200.3.15.1
0.13.1+git.1667812208.4db963e-150200.3.15.1
saphanabootstrap-formula
SUSE:Linux Enterprise Module for SAP Applications 15 SP1
 before 0.13.1+git.1667812208.4db963e-150000.1.19.1
0.13.1+git.1667812208.4db963e-150000.1.19.1
saphanabootstrap-formula
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 0.13.1+git.1667812208.4db963e-4.18.1
0.13.1+git.1667812208.4db963e-4.18.1
saphanabootstrap-formula
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 0.13.1+git.1667812208.4db963e-4.18.1
0.13.1+git.1667812208.4db963e-4.18.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-45153 is a high vulnerability (CVSS 7.0) in Opensuse Leap, published January 2, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in saphanabootstrap-formula 0.13.1+git.1667812208.4db963e-150200.3.15.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open