sosreport does not blank root password in anaconda plugin

🗓️ 19 Jun 2012 15:23:00Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 1 Views

Sosreport before version 2.2-29 fails to remove root password data from Kickstart file in Anaconda plugin.

Reporter	Title	Published	Views	Family All 37
BDU FSTEC	The vulnerability of the Red Hat Enterprise Linux operating system allows a remote attacker to compromise the confidentiality of protected information.	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the CentOS operating system allows a malicious attacker to compromise the confidentiality of protected information.	28 Apr 201500:00	–	bdu_fstec
Tenable Nessus	CentOS 6 : sos (CESA-2012:0958)	11 Jul 201200:00	–	nessus
Tenable Nessus	CentOS 5 : sos (CESA-2013:1121)	31 Jul 201300:00	–	nessus
Tenable Nessus	MiracleLinux 4 : sos-2.2-29.0.1.AXS4 (AXSA:2012-573:02)	14 Jan 202600:00	–	nessus
Tenable Nessus	MiracleLinux 3 : sos-1.7-9.62.1.0.1.AXS3 (AXSA:2013-582:01)	16 Jan 202600:00	–	nessus
Tenable Nessus	Oracle Linux 6 : sos (ELSA-2012-0958)	12 Jul 201300:00	–	nessus
Tenable Nessus	Oracle Linux 5 : sos (ELSA-2013-1121)	31 Jul 201300:00	–	nessus
Tenable Nessus	RHEL 6 : sos (RHSA-2012:0958)	20 Jun 201200:00	–	nessus
Tenable Nessus	RHEL 5 : sos (RHSA-2013:1121)	31 Jul 201300:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	6	any	sos	0:2.2-29.el6	sos-0:2.2-29.el6.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2012-2664
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2012-2664
cve	www.cve.org/CVERecord

21 Nov 2025 17:40Current

5.8Medium risk

Vulners AI Score5.8

CVSS 24.3

EPSS0.00438

root password kickstart file anaconda plugin sosreport password hashes exposure