CVE-2015-7529
Fixed in a distro release EPSS <1%
sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$date.
Products: sos_project sos, canonical ubuntu_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_eus, redhat enterprise_linux_server_tus, redhat enterprise_linux_workstation
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | sosreport | 3.3 |
| PyPI | sosreport | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | sosreport | 3.2+git276-g7da50d6-3 |
| Red Hat Enterprise Linux 6 | sos | 0:3.2-28.el6_7.2 |
| Red Hat Enterprise Linux 7 | sos | 0:3.2-35.el7_2.3 |
| Ubuntu 14.04 LTS | sosreport | 3.1-1ubuntu2.2 |