Sensitive Information Leakage

2019-01-1508:52:52

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.004 Low

EPSS

Percentile

73.6%

JSON

The sos package has a sensitive information leakage vulnerability. During archival of debugging information, the package does not remove the root user password information stored in the Kickstart configuration file (/root/anaconda-ks.cfg) it leaves the root user password information from the Kickstart configuration file (/root/anaconda-ks.cfg) when creating an archive of debugging information, allowing an attacker to access the root user’s password related information at “/root/anaconda-ks.cfg”.

CPENameOperatorVersion
soseq2.2__17.el6
soseq2.2__16.1ssa.el6
soseq2.2__17.1.el6rhs
soseq2.2__17.2.el6rhs
soseq2.2__24.el6
soseq2.2__17.el6_2.1
soseq2.2__17.el6_2.3
soseq2.2__8.el6
soseq2.2__2.el6

Name	Operator	Version
sos	eq	2.2__17.el6
sos	eq	2.2__16.1ssa.el6
sos	eq	2.2__17.1.el6rhs
sos	eq	2.2__17.2.el6rhs
sos	eq	2.2__24.el6
sos	eq	2.2__17.el6_2.1
sos	eq	2.2__17.el6_2.3
sos	eq	2.2__8.el6
sos	eq	2.2__2.el6