GitHub Advisoryadvisory · PyPI

GHSA-3g56-2hh3-35ph SoSReport Predictable Tmp File Names

HIGH Published 2022-05-13 Modified 2024-10-27 Official page ↗
Aliases
CVE-2015-7529
Ecosystem
PyPI
Packages
sosreport
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-59
Reviewed
2023-08-02

Affected packages

• PyPI sosreport: >= 3.0, < 3.3 → fixed in 3.3

Description

sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by `sosreport-$hostname-$date.tar` in `/tmp/sosreport-$hostname-$date`.

Related

Alias · CVE (1)

  • CVE-2015-7529 sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an… vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References