CVE-2018-14650: Medium severity sos-collector vulnerability
It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the /var/tmp directory.
Other sources
sos-collector does not set any permission when creating new files, thus the default umask is used, making all newly created files readable by all local users. Given the delicacy of the data collected by sos-collector, all files created by the tool, including the sos-reports collected from the cluster machines, should be accessible only the to current user. A local attacker can use this flaw to read sensitive information collected from other machines when a legit user runs sos-collector.
Upstream patch: https://github.com/sosreport/sos-collector/commit/72058f9253e7ed8c7243e2ff76a16d97b03d65ed
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-14650?
CVE-2018-14650 is classified as a high severity vulnerability due to its potential to expose sensitive data to local attackers.
How do I fix CVE-2018-14650?
To fix CVE-2018-14650, update sos-collector to version 1.4.1 or later, which includes a patch for this vulnerability.
Who is affected by CVE-2018-14650?
CVE-2018-14650 affects users of sos-collector version 1.4 on Red Hat Enterprise Linux systems.
What type of attacks can exploit CVE-2018-14650?
A local attacker can exploit CVE-2018-14650 to access collected data by manipulating file permissions created by sos-collector.
When was CVE-2018-14650 disclosed?
CVE-2018-14650 was disclosed in 2018 and is associated with security advisory RHSA-2018:3663.