Description
The sosreport utility in the Red Hat sos package before 1.7-9 and 2.x before 2.2-17 includes (1) Certificate-based Red Hat Network private entitlement keys and the (2) private key for the entitlement in an archive of debugging information, which might allow remote attackers to obtain sensitive information by reading the archive.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | sos | 2.2-17.el6 | RHSA-2011:1536 |
| RHEL 5 | sos | 1.7-9.62.el5 | RHSA-2012:0153 |
Advisories 2
- RHSA-2012:0153 Red Hat Security Advisory: sos security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2011:1536 Red Hat Security Advisory: sos security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2012:0153 vendor-advisory
- RHSA-2011:1536 vendor-advisory