CVE-2015-3171 sosreport sensitive information disclosure via weak permissions of the generated archives
MediumCVSS 5.5
EPSS 0.34%
- Published
- Updated
- Exploit status
- No public exploit known
Description
sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi sosreport(PyPI) | < 3.3 | 3.3 |
| pypi sosreport(PyPI) | = 3.2 | No fix listed |
| pypi sosreport(PyPI) | = 3.2.0a1 | No fix listed |
| pypi sosreport(PyPI) | >= 3.0 | No fix listed |
| pypi sosreport(PyPI) | = 3.2alpha1 | No fix listed |
| pypi sosreport(PyPI) | = 3.1 | No fix listed |
| pypi sosreport(PyPI) | = r3.0 | No fix listed |
| pypi sosreport(PyPI) | = 3.0 | No fix listed |
| pypi sosreport(PyPI) | = rhel-6-start | No fix listed |
| pypi sosreport(PyPI) | = as7.1.2 | No fix listed |
| pypi sosreport(PyPI) | = AS7-7.1.2 | No fix listed |
| pypi sosreport(PyPI) | = r2.1 | No fix listed |
| pypi sosreport(PyPI) | = r2.0 | No fix listed |
| pypi sosreport(PyPI) | = r1.9 | No fix listed |
| pypi sosreport(PyPI) | = r1.8 | No fix listed |
| pypi sosreport(PyPI) | = rhel-5-start | No fix listed |
| pypi sosreport(PyPI) | = r1.7-8 | No fix listed |
| pypi sosreport(PyPI) | = rhel-4-start | No fix listed |
| pypi sosreport(PyPI) | = r1.7-6 | No fix listed |
| pypi sosreport(PyPI) | = r1.7 | No fix listed |
| pypi sosreport(PyPI) | = r1.6 | No fix listed |
| debian/sosreport(Debian:12) | < 3.2-2 | 3.2-2 |
| sos project sos | = 3.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com issue-tracking patch third-party-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- github.com
- github.com product
- github.com vendor-advisory
- Debian Security Tracker CVE-2015-3171 vendor-advisory
- bugs.debian.org issue-tracking