CVE-2018-14650

Fixed in a distro release EPSS <1%CVSS 5.9

It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the /var/tmp directory.

Published 2018-09-27 · CVE record · OSV

Products: sos-collector_project sos-collector, redhat enterprise_linux_desktop, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_eus, redhat enterprise_linux_workstation

Distro releases