GHSA-gw46-8559-cggp

Source

https://github.com/advisories/GHSA-gw46-8559-cggp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-gw46-8559-cggp/GHSA-gw46-8559-cggp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gw46-8559-cggp

Aliases

Published

2022-05-13T01:30:21Z

Modified

2024-10-25T15:01:07Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

sosreport sensitive information disclosure via weak permissions of the generated archives

Details

sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive.

Database specific

{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-04-29T14:43:29Z",
    "nvd_published_at":  "2017-07-25T18:29:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / sosreport

Package

Name: sosreport; View open source insights on deps.dev
Purl: pkg:pypi/sosreport

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.3

Affected versions

3.*

3.2.0a1

3.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-gw46-8559-cggp/GHSA-gw46-8559-cggp.json"