Description
sosreport in Red Hat sos 1.7 and earlier on Red Hat Enterprise Linux (RHEL) 5 produces an archive with an fstab file potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | sosreport | 3.1-1ubuntu2.2 | USN-2845-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | sos | 1.7-9.73.el5 | RHBA-2014:1200 |
Advisories 2
- USN-2845-1 sosreport vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- RHBA-2014:1200 Red Hat Bug Fix Advisory: sos bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- [oss-security] 20140529 CVE request: sos: /etc/fstab collected by sosreport, possibly containing passwords mailing-list
- USN-2845-1 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1102633
- [oss-security] 20140530 Re: CVE request: sos: /etc/fstab collected by sosreport, possibly containing passwords mailing-list