PyPI: sosreport
CVE-2015-3171
Safety vulnerability ID: SFTY-20170725-69233
Safety legacy ID: pyup.io-42239
sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive.
Overview
sosreport sensitive information disclosure via weak permissions of the generated archives
Advisory
sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive.
How to Fix
We recommend updating sosreport to the latest non-vulnerable version.
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20170725-69233/CVE-2015-3171
- https://nvd.nist.gov/vuln/detail/CVE-2015-3171
- https://github.com/sosreport/sos/commit/d7759d3ddae5fe99a340c88a1d370d65cfa73fd6
- https://bugzilla.redhat.com/show_bug.cgi?id=1218658
- https://github.com/sosreport/sos/issues/425
- https://github.com/pypa/advisory-database/tree/main/vulns/sosreport/PYSEC-2017-72.yaml
- https://github.com/advisories/GHSA-gw46-8559-cggp
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more