Description
The sosreport utility in the Red Hat sos package before 2.2-29 does not remove the root user password information from the Kickstart configuration file (/root/anaconda-ks.cfg) when creating an archive of debugging information, which might allow attackers to obtain passwords or password hashes.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | sos | 2.2-29.el6 | RHSA-2012:0958 |
| RHEL 5 | sos | 1.7-9.62.el5_9.1 | RHSA-2013:1121 |
Advisories 2
- RHSA-2013:1121 Red Hat Security Advisory: sos security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2012:0958 Red Hat Security Advisory: sos security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- RHSA-2012:0958 vendor-advisory
- RHSA-2013:1121 vendor-advisory
- sos-anaconda-info-disclosure(76468) vdb-entry
- 54116 vdb-entry