PT-2014-2156 · Red Hat · Sos+1

Published 2011-12-05 · Updated 2014-02-19 · CVE-2011-4083

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat sos package versions prior to 1.7-9 Red Hat sos package versions 2.x prior to 2.2-17

Description The sosreport utility includes sensitive information, such as certificate-based Red Hat Network private entitlement keys and the private key for the entitlement, in an archive of debugging information. This could allow remote attackers to obtain sensitive information by reading the archive.

Recommendations For Red Hat sos package versions prior to 1.7-9, update to version 1.7-9 or later. For Red Hat sos package versions 2.x prior to 2.2-17, update to version 2.2-17 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2011-4083

RHSA-2011:1536

RHSA-2011_1536

RHSA-2012:0153

RHSA-2012_0153

Affected Products

Red Hat

Sos

References · 7

• http://rhn.redhat.com/errata/RHSA-2012-0153.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2011-1536.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-1536.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4083 · Security Note
• https://access.redhat.com/errata/RHSA-2011:1536 · Note
• https://access.redhat.com/security/cve/CVE-2011-4083 · Note
• https://access.redhat.com/errata/RHSA-2012:0153 · Note