Upstream information
Description
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and 0.8.3, Himmelblau is vulnerable to leaking credentials in debug logs. When debug logging is enabled, user access tokens are inadvertently logged, potentially exposing sensitive authentication data. Similarly, Kerberos Ticket-Granting Tickets (TGTs) are logged when debug logging is enabled. Both issues pose a risk of exposing sensitive credentials, particularly in environments where debug logging is enabled. Himmelblau versions 0.7.15 and 0.8.3 contain a patch that fixes both issues. Some workarounds are available for users who are unable to upgrade. For the **logon compliance script issue**, disable the `logon_script` option in `/etc/himmelblau/himmelblau.conf`, and avoid using the `-d` flag when starting the `himmelblaud` daemon. For the Kerberos CCache issue, one may disable debug logging globally by setting the `debug` option in `/etc/himmelblau/himmelblau.conf` to `false` and avoiding the `-d` parameter when starting `himmelblaud`.SUSE information
Overall state of this security issue: Pending
This issue is currently not rated by SUSE as it is not affecting the SUSE Enterprise products.
| CNA (GitHub) | SUSE | |
|---|---|---|
| Base Score | 3.2 | 3.2 |
| Vector | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N |
| Attack Vector | Local | Local |
| Attack Complexity | Low | Low |
| Privileges Required | High | High |
| User Interaction | None | None |
| Scope | Changed | Changed |
| Confidentiality Impact | Low | Low |
| Integrity Impact | None | None |
| Availability Impact | None | None |
| CVSSv3 Version | 3.1 | 3.1 |
| SUSE | |
|---|---|
| Base Score | 1.8 |
| Vector | CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| Attack Vector | Local |
| Attack Complexity | Low |
| Attack Requirements | Present |
| Privileges Required | High |
| User Interaction | None |
| Vulnerable System Confidentiality Impact | Low |
| Vulnerable System Integrity Impact | None |
| Vulnerable System Availability Impact | None |
| Subsequent System Confidentiality Impact | None |
| Subsequent System Integrity Impact | None |
| Subsequent System Availability Impact | None |
| CVSSv4 Version | 4.0 |
SUSE Timeline for this CVE
CVE page created: Thu Jan 23 20:01:55 2025CVE page last modified: Fri Jan 24 22:17:05 2025