sos project vulnerabilities

Products

• sos 3

Latest sos project CVEs

Newest publication first

1. CVE-2022-2806 sosreport Exposure of Sensitive Information vulnerability

   Published 2022-09-01

   Medium·CVSS 5.5 EPSS 0.25%

   It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev

2. CVE-2015-7529 SoSReport Predictable Tmp File Names

   Published 2017-11-06

   High·CVSS 7.8 EPSS 0.44%

   sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$date.

3. CVE-2015-3171 sosreport sensitive information disclosure via weak permissions of the generated archives

   Published 2017-07-25

   Medium·CVSS 5.5 EPSS 0.34%

   sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.