CVE-2014-0246 SOSreport stores the md5 hash of the GRUB bootloader password in an archive, which allows local users to obtain sensitive information by reading the archive.
MediumCVSS 4.3
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SOSreport stores the md5 hash of the GRUB bootloader password in an archive, which allows local users to obtain sensitive information by reading the archive.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/sosreport(Debian:12) | All versions | No fix listed |
| debian/sosreport(Debian:12) | = 4.0-2 | No fix listed |
| debian/sosreport(Debian:12) | = 4.0-2.1 | No fix listed |
| debian/sosreport(Debian:12) | = 4.7.1-1.1 | No fix listed |
| debian/sosreport(Debian:12) | = 4.7.2-0.1 | No fix listed |
| debian/sosreport(Debian:12) | = 4.7.2-0.2 | No fix listed |
| debian/sosreport(Debian:12) | = 4.7.2-1 | No fix listed |
| debian/sosreport(Debian:12) | = 4.7.2-2 | No fix listed |
| debian/sosreport(Debian:12) | = 4.7.2-3 | No fix listed |
| debian/sosreport(Debian:12) | = 4.8.0-1 | No fix listed |
| debian/sosreport(Debian:12) | = 4.8.1-1 | No fix listed |
| debian/sosreport(Debian:12) | = 4.8.1-2 | No fix listed |
| debian/sosreport(Debian:12) | = 4.8.1-2~bpo12+1 | No fix listed |
| debian/sosreport(Debian:12) | = 4.8.2-1 | No fix listed |
| debian/sosreport(Debian:12) | = 4.8.2-2 | No fix listed |
| debian/sosreport(Debian:12) | = 4.8.2-2~bpo12+1 | No fix listed |
| debian/sosreport(Debian:12) | = 4.8.2-3 | No fix listed |
| sosreport project sosreport | All versions | No fix listed |
References
- Debian Security Tracker CVE-2014-0246 vendor-advisory
- [oss-security] 20140527 CVE-2014-0246 sos: md5 hash of GRUB password collected when running sosreport mailing-list
- 67634 vdb-entry
- bugzilla.redhat.com
- bugs.debian.org issue-tracking