Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
SUSE Manager Client Tools security update fixes database credential storage
published 1 year ago
Summary
SUSE Manager Client Tools has received a security update to fix a vulnerability in how it stores database credentials. This update is important to protect sensitive information and prevent unauthorized access. Users should apply this update to their systems to ensure they have the latest security patches.
What to do
- Update suse scap-security-guide to version 0.1.75-1.32.1.
- Update suse spacecmd to version 5.0.11-1.44.1.
- Update suse uyuni-tools to version 0.1.28-1.14.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | suse | scap-security-guide |
< 0.1.75-1.32.1 Fix: upgrade to 0.1.75-1.32.1
|
| SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | suse | spacecmd |
< 5.0.11-1.44.1 Fix: upgrade to 5.0.11-1.44.1
|
| SUSE:Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS | suse | uyuni-tools |
< 0.1.28-1.14.1 Fix: upgrade to 0.1.28-1.14.1
|
Original advisory text
Security update for SUSE Manager Client Tools
This update fixes the following issues:
scap-security-guide was updated to version 0.1.75 (jsc#ECO-3319):
- Added Ism profile for OL8, OL9
- Added new product kylinserver10
- Created OL10 product
- Release SLMicro5 product
- Replaced two date injections by SOURCE_DATE_EPOCH to make reproducible (bsc#1230361)
- Updated PCI-DSS control file for version 4.0.1
spacecmd was updated to version 5.0.11-0:
- Updated translation strings
uyuni-tools was updated from version 0.1.23-0 to 0.1.27-0:
- Security issues fixed:
* CVE-2024-22037: Use podman secret to store the database credentials (bsc#1231497)
- Other changes and bugs fixed:
* Version 0.1.27-0
+ Bump the default image tag to 5.0.3
+ IsInstalled function fix
+ Run systemctl daemon-reload after changing the container image config (bsc#1233279)
+ Coco-replicas-upgrade
+ Persist search server indexes (bsc#1231759)
+ Sync deletes files during migration (bsc#1233660)
+ Ignore coco and hub images when applying PTF if they are not ailable (bsc#1229079)
+ Add --registry back to mgrpxy (bsc#1233202)
+ Only add java.hostname on migrated server if not present
+ Consider the configuration file to detect the coco or hub api images should be pulled (bsc#1229104)
+ Only raise an error if cloudguestregistryauth fails for PAYG (bsc#1233630)
+ Add registry.suse.com login to mgradm upgrade podman list (bsc#1234123)
* Version 0.1.26-0
+ Ignore all zypper caches during migration (bsc#1232769)
+ Use the uyuni network for all podman containers (bsc#1232817)
* Version 0.1.25-0
+ Don't migrate enabled systemd services, recreate them (bsc#1232575)
* Version 0.1.24-0
+ Redact JSESSIONID and pxt-session-cookie values from logs and
console output (bsc#1231568)
scap-security-guide was updated to version 0.1.75 (jsc#ECO-3319):
- Added Ism profile for OL8, OL9
- Added new product kylinserver10
- Created OL10 product
- Release SLMicro5 product
- Replaced two date injections by SOURCE_DATE_EPOCH to make reproducible (bsc#1230361)
- Updated PCI-DSS control file for version 4.0.1
spacecmd was updated to version 5.0.11-0:
- Updated translation strings
uyuni-tools was updated from version 0.1.23-0 to 0.1.27-0:
- Security issues fixed:
* CVE-2024-22037: Use podman secret to store the database credentials (bsc#1231497)
- Other changes and bugs fixed:
* Version 0.1.27-0
+ Bump the default image tag to 5.0.3
+ IsInstalled function fix
+ Run systemctl daemon-reload after changing the container image config (bsc#1233279)
+ Coco-replicas-upgrade
+ Persist search server indexes (bsc#1231759)
+ Sync deletes files during migration (bsc#1233660)
+ Ignore coco and hub images when applying PTF if they are not ailable (bsc#1229079)
+ Add --registry back to mgrpxy (bsc#1233202)
+ Only add java.hostname on migrated server if not present
+ Consider the configuration file to detect the coco or hub api images should be pulled (bsc#1229104)
+ Only raise an error if cloudguestregistryauth fails for PAYG (bsc#1233630)
+ Add registry.suse.com login to mgradm upgrade podman list (bsc#1234123)
* Version 0.1.26-0
+ Ignore all zypper caches during migration (bsc#1232769)
+ Use the uyuni network for all podman containers (bsc#1232817)
* Version 0.1.25-0
+ Don't migrate enabled systemd services, recreate them (bsc#1232575)
* Version 0.1.24-0
+ Redact JSESSIONID and pxt-session-cookie values from logs and
console output (bsc#1231568)
References
- https://www.suse.com/support/update/announcement//suse-el-9-client-tools-2025-53... Vendor Advisory
- https://bugzilla.suse.com/1229079 Third Party Advisory
- https://bugzilla.suse.com/1229104 Third Party Advisory
- https://bugzilla.suse.com/1230361 Third Party Advisory
- https://bugzilla.suse.com/1231497 Third Party Advisory
- https://bugzilla.suse.com/1231568 Third Party Advisory
- https://bugzilla.suse.com/1231759 Third Party Advisory
- https://bugzilla.suse.com/1232575 Third Party Advisory
- https://bugzilla.suse.com/1232769 Third Party Advisory
- https://bugzilla.suse.com/1232817 Third Party Advisory
- https://bugzilla.suse.com/1233202 Third Party Advisory
- https://bugzilla.suse.com/1233279 Third Party Advisory
- https://bugzilla.suse.com/1233630 Third Party Advisory
- https://bugzilla.suse.com/1233660 Third Party Advisory
- https://bugzilla.suse.com/1234123 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2024-22037 URL
Timeline
Published14 Feb 2025
Updated24 Jul 2026
First seen24 Jul 2026
Sources
Track software like this
Free during beta