{"id":"CVE-2025-46809","aliases":["EUVD-2025-23274","GHSA-6c9h-8vxc-74xh","SUSE-SU-2025:02475-1","SUSE-SU-2025:02476-1"],"status":"published","title":"Multi Linux Manager epxoses the plain text HTTP Proxy user:password in logs","description":"A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. This issue affects Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1: from ? before 4.3.33-150400.3.55.2; Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1: from ? before 5.0.14-150600.4.17.1; Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.14-150600.4.17.1; Image SLES15-SP4-Manager-Proxy-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; SUSE Manager Proxy Module 4.3: from ? before 4.3.33-150400.3.55.2; SUSE Manager Server Module 4.3: from ? before 4.3.33-150400.3.55.2.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00279,"percentile":0.20503,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-256","CWE-532"],"published":"2025-07-23T12:36:44Z","modified":"2026-06-17T09:26:58Z","affected":[{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"uyuni-proxy-systemd-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150000.1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"uyuni-proxy-systemd-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150000.1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"mgr-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.12-150400.3.24.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.31-150400.3.48.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.33-150400.3.55.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.23-150400.3.39.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-proxy-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.12-150400.3.9.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.45-150400.3.60.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-150400.3.9.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"supportutils-plugin-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-150400.3.9.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.4.11-150400.3.35.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"susemanager-tftpsync-recv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-150400.3.12.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"uyuni-proxy-systemd-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150000.1.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-150400.5.58.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"grafana-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-150400.3.24.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"inter-server-sync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.7-150400.3.39.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.31-150400.3.48.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.14-150400.3.15.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.33-150400.3.55.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.23-150400.3.39.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150400.3.24.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.87-150400.3.110.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.24-150400.3.35.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.45-150400.3.60.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.40-150400.3.28.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"supportutils-plugin-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.15-150400.3.33.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.42-150400.3.66.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.4.11-150400.3.35.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150400.9.72.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.29-150400.3.51.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.47-150400.3.61.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.24-150400.3.44.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150400.3.98.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16-150400.3.140.1"}]}],"bundled":15}],"products":[{"vendor":"suse","product":"container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1"},{"vendor":"suse","product":"container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1"},{"vendor":"suse","product":"container suse/manager/5.0/x86_64/server:5.0.5.7.30.1"},{"vendor":"suse","product":"image sles15-sp4-manager-proxy-4-3-byos"},{"vendor":"suse","product":"image sles15-sp4-manager-proxy-4-3-byos-azure"},{"vendor":"suse","product":"image sles15-sp4-manager-proxy-4-3-byos-ec2"},{"vendor":"suse","product":"image sles15-sp4-manager-proxy-4-3-byos-gce"},{"vendor":"suse","product":"image sles15-sp4-manager-server-4-3-byos"},{"vendor":"suse","product":"image sles15-sp4-manager-server-4-3-byos-azure"},{"vendor":"suse","product":"image sles15-sp4-manager-server-4-3-byos-ec2"},{"vendor":"suse","product":"image sles15-sp4-manager-server-4-3-byos-gce"},{"vendor":"suse","product":"suse manager proxy module 4.3"},{"vendor":"suse","product":"suse manager server module 4.3"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46809"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46809"},{"url":"https://github.com/advisories/GHSA-6c9h-8vxc-74xh"},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502475-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1157520","tags":["report"]},{"url":"https://bugzilla.suse.com/1191142","tags":["report"]},{"url":"https://bugzilla.suse.com/1209060","tags":["report"]},{"url":"https://bugzilla.suse.com/1211373","tags":["report"]},{"url":"https://bugzilla.suse.com/1213952","tags":["report"]},{"url":"https://bugzilla.suse.com/1216187","tags":["report"]},{"url":"https://bugzilla.suse.com/1221031","tags":["report"]},{"url":"https://bugzilla.suse.com/1225740","tags":["report"]},{"url":"https://bugzilla.suse.com/1230403","tags":["report"]},{"url":"https://bugzilla.suse.com/1230908","tags":["report"]},{"url":"https://bugzilla.suse.com/1233371","tags":["report"]},{"url":"https://bugzilla.suse.com/1234608","tags":["report"]},{"url":"https://bugzilla.suse.com/1236635","tags":["report"]},{"url":"https://bugzilla.suse.com/1236779","tags":["report"]},{"url":"https://bugzilla.suse.com/1236810","tags":["report"]},{"url":"https://bugzilla.suse.com/1236877","tags":["report"]},{"url":"https://bugzilla.suse.com/1236910","tags":["report"]},{"url":"https://bugzilla.suse.com/1237060","tags":["report"]},{"url":"https://bugzilla.suse.com/1237082","tags":["report"]},{"url":"https://bugzilla.suse.com/1237294","tags":["report"]},{"url":"https://bugzilla.suse.com/1237403","tags":["report"]},{"url":"https://bugzilla.suse.com/1237581","tags":["report"]},{"url":"https://bugzilla.suse.com/1237694","tags":["report"]},{"url":"https://bugzilla.suse.com/1237770","tags":["report"]},{"url":"https://bugzilla.suse.com/1238922","tags":["report"]},{"url":"https://bugzilla.suse.com/1238924","tags":["report"]},{"url":"https://bugzilla.suse.com/1239102","tags":["report"]},{"url":"https://bugzilla.suse.com/1239154","tags":["report"]},{"url":"https://bugzilla.suse.com/1239604","tags":["report"]},{"url":"https://bugzilla.suse.com/1239743","tags":["report"]},{"url":"https://bugzilla.suse.com/1239826","tags":["report"]},{"url":"https://bugzilla.suse.com/1239868","tags":["report"]},{"url":"https://bugzilla.suse.com/1239907","tags":["report"]},{"url":"https://bugzilla.suse.com/1240038","tags":["report"]},{"url":"https://bugzilla.suse.com/1240386","tags":["report"]},{"url":"https://bugzilla.suse.com/1240666","tags":["report"]},{"url":"https://bugzilla.suse.com/1240842","tags":["report"]},{"url":"https://bugzilla.suse.com/1241239","tags":["report"]},{"url":"https://bugzilla.suse.com/1241286","tags":["report"]},{"url":"https://bugzilla.suse.com/1241455","tags":["report"]},{"url":"https://bugzilla.suse.com/1241490","tags":["report"]},{"url":"https://bugzilla.suse.com/1242004","tags":["report"]},{"url":"https://bugzilla.suse.com/1242030","tags":["report"]},{"url":"https://bugzilla.suse.com/1242148","tags":["report"]},{"url":"https://bugzilla.suse.com/1242554","tags":["report"]},{"url":"https://bugzilla.suse.com/1242911","tags":["report"]},{"url":"https://bugzilla.suse.com/1243239","tags":["report"]},{"url":"https://bugzilla.suse.com/1243460","tags":["report"]},{"url":"https://bugzilla.suse.com/1243724","tags":["report"]},{"url":"https://bugzilla.suse.com/1243825","tags":["report"]},{"url":"https://bugzilla.suse.com/1244065","tags":["report"]},{"url":"https://bugzilla.suse.com/1244290","tags":["report"]},{"url":"https://bugzilla.suse.com/1245005","tags":["report"]},{"url":"https://bugzilla.suse.com/1245027","tags":["report"]},{"url":"https://bugzilla.suse.com/1245222","tags":["report"]},{"url":"https://bugzilla.suse.com/1245368","tags":["report"]},{"url":"https://bugzilla.suse.com/1246119","tags":["report"]},{"url":"https://bugzilla.suse.com/1246788","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46811","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502476-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22242","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-46809","title":"Multi Linux Manager epxoses the plain text HTTP Proxy user:password in logs","description":"A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. This issue affects Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1: from ? before 4.3.33-150400.3.55.2; Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1: from ? before 5.0.14-150600.4.17.1; Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.14-150600.4.17.1; Image SLES15-SP4-Manager-Proxy-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; SUSE Manager Proxy Module 4.3: from ? before 4.3.33-150400.3.55.2; SUSE Manager Server Module 4.3: from ? before 4.3.33-150400.3.55.2.","status":"published","published":"2025-07-31T15:24:41.89Z","modified":"2025-09-03T07:12:41.584Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-256"],"updated_at":"2026-11-02T14:32:36.706507Z"}],"euvd":[{"id":"EUVD-2025-23274","description":"A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. This issue affects Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1: from ? before 4.3.33-150400.3.55.2; Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1: from ? before 5.0.14-150600.4.17.1; Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.14-150600.4.17.1; Image SLES15-SP4-Manager-Proxy-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; SUSE Manager Proxy Module 4.3: from ? before 4.3.33-150400.3.55.2; SUSE Manager Server Module 4.3: from ? before 4.3.33-150400.3.55.2.","status":"published","published":"2025-07-31T15:24:41Z","modified":"2025-09-03T07:12:41Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:31:48.3448Z"}],"ghsa":[{"id":"GHSA-6c9h-8vxc-74xh","title":"A Insertion of Sensitive Information into Log File vulnerability in SUSE Multi Linux Manager...","description":"A Insertion of Sensitive Information into Log File vulnerability in SUSE Multi Linux Manager exposes the HTTP proxy credentials. This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.87-150400.3.110.2; SUSE Manager Server Module 4.3: from ? before 4.3.87-150400.3.110.2.","status":"published","published":"2025-07-31T18:32:03Z","modified":"2025-07-31T18:32:10Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:03:09.647668Z"}],"nvd":[{"id":"CVE-2025-46809","description":"A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. This issue affects Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1: from ? before 4.3.33-150400.3.55.2; Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1: from ? before 5.0.14-150600.4.17.1; Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.14-150600.4.17.1; Image SLES15-SP4-Manager-Proxy-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; SUSE Manager Proxy Module 4.3: from ? before 4.3.33-150400.3.55.2; SUSE Manager Server Module 4.3: from ? before 4.3.33-150400.3.55.2.","status":"published","published":"2025-07-31T16:15:30.153Z","modified":"2026-06-17T09:26:58.09Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-256"],"updated_at":"2026-11-02T14:11:21.71471Z"}],"osv":[{"id":"SUSE-SU-2025:02475-1","title":"Security update 4.3.16 for Multi-Linux Manager Server","description":"This update fixes the following issues:\n\ncobbler:\n\n- Prevent crash during Cobbler startup on NFS environments (bsc#1240666)\n- Synchronize cobbler add and sync actions (bsc#1233371)\n- Exclude disabled profiles from buildiso gen (bsc#1230908)\n\ngrafana-formula:\n\n- Version 4.3.0:\n  * Added SUSE Linux Enterprise Server 15 SP7 to the supported versions (bsc#1245368)\n  * Dropped old unsupported SUSE versions from the supported versions list\n  * Migrated from deprecated Graph panels to new timeseries panels\n\ninter-server-sync:\n\n- Version 0.3.7-0:\n  * Added SSL signed export and import validation (bsc#1241239)\n- Version 0.3.6-0:\n  * Included /var/log/hub (bsc#1243724)\n\nspacecmd:\n\n- Version 4.3.31-0:\n  * Improved translation update process\n\nspacewalk-admin:\n    \n- Version 4.3.33-0\n  * Security issues fixed:\n    + CVE-2025-46809: Do not expose HTTP Proxy password when breaking URL format (bsc#1245005)\n  * Other bugs fixed:\n    + Enhance permissions for reposync zypper cache\n- Version 4.3.14-0:\n  * Added support for environment variables in rhn-config-satellite (bsc#1242148)\n  * mgr-monitoring-ctl: avoid possible errors due to non-ascii characters (bsc#1242030)\n\nspacewalk-backend:\n\n- Version 4.3.32-0\n  * Removed python3-simplejson use in spacewalk-repo-sync (bsc#1236635)\n  * Improved translation update process\n  * Make reposync allow commas as part of HTTP Proxy password (bsc#1243460)\n  * Removed bootloader linux and initrd files from spacewalk-debug\n  * Use libzypp's Curl2 backend during reposync (bsc#1245222)\n\nspacewalk-client-tools:\n\n- Version 4.3.23-0\n  * Improved translation update process\n\nspacewalk-config:\n\n- Version 4.3.16-0\n  * Allow passing environment variables to rhn-config-satellite (bsc#1242148)\n\nspacewalk-java:\n\n- Version 4.3.87-0\n  * Security issues fixed:\n    + CVE-2025-46811: Clean up stale sessions on websocket open (bsc#1246119)\n- Version 4.3.86-0:\n  * Security issues fixed:\n    + CVE-2025-23393: Filter user input in systems list page (bsc#1240386)\n  * Other bugs fixed:\n    + Fixed tooltip text for icons in the patches list (bsc#1234608)\n    + Fixed openscap audit is running immediately even when scheduled for next days (bsc#1239743)\n    + Adds calling a highstate in the API for actionchain (bsc#1157520)\n    + Fixed behavior of `reboot_suggested` or `restart_suggested` by API (bsc#1236910)\n    + Fixed action chain scheduled within SSM creates no link for the new action chain (bsc#1243825)\n    + Fixed severity levels missing in API output of errata.getDetails (bsc#1240038)\n    + Fixed internal server error when accessing groups in activation keys (bsc#1237581)\n    + Fixed http_proxy_password stored as clear text in /var/log/messages (bsc#1242148)\n    + Fixed `manage errors` in user-defined pillars (bsc#1230403)\n    + In CLM live-patching template form, show kernel versions from base product as well (bsc#1239907)\n    + Improved handling of system list filtering (bsc#1242004)\n    + Fixed issue preventing OES products from showing up (bsc#1237082)\n    + Fixed config channels not following priority in highstate (bsc#1237694)\n    + Improved performance when changing channels on multiple system through SSM (bsc#1239154)\n    + Fixed package locking for packages not available anymore in the assigned repositories (bsc#1236877)\n    + Do not show Vendor Advisory link for SL-Micro 6.0 and 6.1 products (bsc#1237770)\n    + Fixed API namespace for AdminPaygHandler\n    + Fixed CLM channel name definition (bsc#1239868)\n    + Fixed XMLRPC API endpoint updateRepoSsl repository property\n    + Fixed API documentation for system config listFiles (bsc#1245027)\n    + Fixed inconsistency in task schedule deactivation and add activation capability (bsc#1225740)\n\nspacewalk-utils:\n\n- Version 4.3.24-0:\n  * Removed spacewalk-clone-by-date dependency on python3-simplejson\n\nspacewalk-web:\n\n- Version 4.3.45-0:\n  * Security issues fixed:\n    + CVE-2025-23392, CVE-2025-23393: Filter user input in systems list page (bsc#1239826, bsc#1240386)\n  * Other bugs fixed:\n    + Fix: Filters of type Product Temporary Fix cannot be created (bsc#1238922)\n    + Improved handling of system list filtering (bsc#1242004)\n    + Improved translation update process\n\nsubscription-matcher:\n\n- Version 0.40:\n  * Fixed integer overflow which can cause a division by zero error (bsc#1243239)\n- Version 0.39:\n  * Fixed the wrong matching for 2 Sockets or 2 VMs subscription string (bsc#1238924)\n  * Fixed logging issues\n  * Updated runtime dependencies\n\nsupportutils-plugin-susemanager:\n\n- Version 4.3.15-0:\n  * Backported supportutils plugin resource functions, replacing the\n    removed supportutils `scplugin.rc` functions with those provided\n    by `supportconfig.rc`\n\nsusemanager:\n\n- Version 4.3.42-0:\n  * Fixed bootstrap repository definition for SLE 15 SP7 and\n    support only bootstrapping with salt-bundle (bsc#1246788)\n- Version 4.3.41-0:\n  * Improved translation update process\n\nsusemanager-build-keys:\n\n- Changed keys to use SHA256 UIDs instead of SHA1 (bsc#1237294, bsc#1236779, jsc#PED-12321)\n  * Renamed `build-alp-09d9ea69-645b99ce.asc` to `build-alp-09d9ea69.asc`\n  * Renamed `gpg-pubkey-3fa1d6ce-63c9481c.asc` to `gpg-pubkey-3fa1d6ce.asc`\n  * Adjusted `suse_ptf_key_2023.asc` and `suse_ptf_key.asc`\n\nsusemanager-docs_en:\n\n- SUSE Manager 4.3.16 Update\n- Added information about missing monitoring package to Administration Guide (bsc#1191142) \n- Added missing script parameters in Installation and Upgrade Guide (bsc#1216187)\n- Added reference to the list of supported SCAP profiles (bsc#1213952)\n- Extended information in an admonition in Specialized Guides  (bsc#1221031)\n- Added missing 4505 and 4506 Salt ports in network requirements in Installation and Upgrade Guide\n- Removed references to the methods no longer used from Reference Guide (bsc#1209060)\n- Fixed Python script in Administration Guide (bsc#1244290)\n- Extended troubleshooting section with a reposync example (bsc#1211373)\n- Added section about enabling SUSE Manager 4.3 LTS in Installation and Upgrade Guide\n- Added missing Task Schedules to the list and updated the Task Schedule page to reflect changes—now only\n  allowing disabling of tasks, not deletion in the Administration Guide\n- Added SUSE Linux Enterprise 15 SP7 as a supported client\n- Fixed asciidoc menu macro issue with duplicate css class, menu items now display correctly\n- Added note about autoyast profiles not having passwords\n- Added details about the behavior of the rescheduled failed action (bsc#1244065)\n- Updated Network Requirement section to add settings for server configuration behind HTTP OSI level 7 Proxy\n- Clarified that NFS with Cobbler is not supported (bsc#1240666)\n- Fixed a URL link in Common Workflows Guide (bsc#1242911)\n- Documented uptodate action in Common Workflows Guide as background information\n- Documented renaming the journal folder when changing machine ID in Administration Guide (bsc#1241286)\n- Fixed removing Salt bundle client procedure in Client Configuration Guide\n- Added referenced target and remove obsolete section in Common Workflows (bsc#1240842, bsc#1242554)\n- Fixed GPG key import command in Administration Guide (bsc#1239102)\n- Added java.smtp_server parameter for mail configuration in Administration Guide (bsc#1241490)\n- Added system_listeventhistory to spacecmd reference in Reference Guide (bsc#1239604)\n- Added links to supported features tables for third party operating systems (bsc#1236810)\n- Fixed typo in Installation and Upgrade Guide (bsc#1237403)\n- Added note to limit Squid's cache_dir size to 60% of available free space in Installation and Upgrade Guide \n\nsusemanager-schema:\n\n- Version 4.3.29-0:\n  * Fixed typo in OES 24.4 channel definition\n\nsusemanager-sls:\n\n- Version 4.3.47-0:\n  * Change uptodate recurring action to use dist-upgrade instead of upgrade for Debian systems (bsc#1237060)\n  * Adjust SLS files for SUSE Linux Enterprise SP7 and other systems running higher Python versions\n  * Optimize SAP module to prevent high IO workload (bsc#1241455)\n\nsusemanager-sync-data:\n\n- Version 4.3.24-0:\n  * Fixed typo in OES 24.4 product definition\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Multi-Linux Manager Server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2025-07-23T12:36:44Z","modified":"2026-03-23T04:46:38.606362Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02476-1","title":"Security update 4.3.16 for Multi-Linux Manager Server","description":"This update fixes the following issues:\n    \nrelease-notes-susemanager:\n\n- Update to SUSE Manager 4.3.16\n  * Important Salt Security Update\n  * Added support for SUSE Linux Enterprise 15 SP7 as a client\n    using the Salt Bundle\n  * CVE Fixed\n    CVE-2025-23392, CVE-2025-23393, CVE-2024-38824, CVE-2025-22239\n    CVE-2025-22236, CVE-2025-22237, CVE-2024-38825, CVE-2025-22240\n    CVE-2024-38823, CVE-2025-22241, CVE-2025-22238, CVE-2025-22242\n    CVE-2024-38822, CVE-2025-46811, CVE-2025-46809\n  * Bugs mentioned:\n    bsc#1157520, bsc#1191142, bsc#1209060, bsc#1211373, bsc#1213952\n    bsc#1216187, bsc#1221031, bsc#1225740, bsc#1230403, bsc#1230908\n    bsc#1233371, bsc#1234608, bsc#1236635, bsc#1236779, bsc#1236810\n    bsc#1236877, bsc#1236910, bsc#1237060, bsc#1237082, bsc#1237294\n    bsc#1237403, bsc#1237581, bsc#1237694, bsc#1237770, bsc#1238922\n    bsc#1238924, bsc#1239102, bsc#1239154, bsc#1239604, bsc#1239743\n    bsc#1239826, bsc#1239868, bsc#1239907, bsc#1240038, bsc#1240386\n    bsc#1240666, bsc#1240842, bsc#1241239, bsc#1241286, bsc#1241455\n    bsc#1241490, bsc#1242004, bsc#1242030, bsc#1242148, bsc#1242554\n    bsc#1242911, bsc#1243239, bsc#1243460, bsc#1243724, bsc#1243825\n    bsc#1244065, bsc#1244290, bsc#1245027, bsc#1245222, bsc#1245368\n    bsc#1245005, bsc#1246119\n\n","status":"published","published":"2025-07-23T12:37:12Z","modified":"2026-03-23T04:46:38.275132Z","updated_at":"2026-11-02T15:53:56.647031Z"}]}}