Description
sysreport 1.3.15 and earlier includes contents of the up2date file in a report, which leaks the password for a proxy server in plaintext and allows local users to gain privileges.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | sysreport | 1.3.7.2-6 | RHSA-2005:502 |
Advisories 1
- RHSA-2005:502 Red Hat Security Advisory: sysreport security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
References
- oval:org.mitre.oval:def:623 vdb-entry signature
- oval:org.mitre.oval:def:9522 vdb-entry signature
- 13936 vdb-entry
- 15675 third-party-advisory
- 1014181 vdb-entry
- RHSA-2005:502 vendor-advisory