Summary
The sos package contains a set of utilities that gather information from system hardware, logs, and configuration files. The information can then be used for diagnostic purposes and debugging.
Security Fix(es):
* sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write (CVE-2026-79655)
Bug Fix(es) and Enhancement(s):
* Hydra to GraphQL migration and sos upload [rhel-9.9.z] (JIRA:Rocky Linux-290949)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | sos | 0:4.11.2-7.el9_9 |
| Rocky Linux · 9 | sos-audit | 0:4.11.2-7.el9_9 |
Vulnerabilities 1
-
High 7.8
Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extract…