Inclusion of Sensitive Information in Log Files in sos - CVE-2022-2806

Vulnerability identifier: #VU67131

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-2806

CWE-ID: CWE-532

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to the application does not apply encryption or obfuscation for the RHV admin password. An attacker with access to the application can gain access to sensitive information.

sos
rhv-log-collector-analyzer (Red Hat package)
ovirt-engine-ui-extensions (Red Hat package)
ovirt-engine-extension-aaa-ldap (Red Hat package)
vdsm-jsonrpc-java (Red Hat package)
ovirt-web-ui (Red Hat package)
ovirt-log-collector (Red Hat package)
ovirt-engine (Red Hat package)
ovirt-engine-dwh (Red Hat package)
sos
sos-help
sosreport (Ubuntu package)
unboundid-ldapsdk (Red Hat package)
Red Hat Virtualization Manager
Ubuntu
openEuler

Install updates from vendor's website.

sos - update to 4.4
rhv-log-collector-analyzer (Red Hat package) - update to 1.0.15-1.el8ev
ovirt-engine-ui-extensions (Red Hat package) - update to 1.3.5-1.el8ev
ovirt-engine-extension-aaa-ldap (Red Hat package) - update to 1.4.6-1.el8ev
vdsm-jsonrpc-java (Red Hat package) - update to 1.7.2-1.el8ev
ovirt-web-ui (Red Hat package) - update to 1.9.1-1.el8ev
ovirt-log-collector (Red Hat package) - update to 4.4.7-2.el8ev
ovirt-engine (Red Hat package) - update to 4.5.2.4-0.1.el8ev
ovirt-engine-dwh (Red Hat package) - update to 4.5.4-1.el8ev
sos - update to 3.8-4
sos-help - update to 3.8-4
sosreport (Ubuntu package) - addressed in versions 4.3-1ubuntu0.18.04.2, 4.3-1ubuntu0.20.04.2, 4.3-1ubuntu2.1
unboundid-ldapsdk (Red Hat package) - update to 6.0.4-1.el8ev

• https://github.com/sosreport/sos/pull/2947
• https://bugzilla.redhat.com/show_bug.cgi?id=2080005

• Information disclosure in sosreport sos
• Multiple vulnerabilities in Red Hat Virtualization Manager
• Ubuntu update for sosreport
• openEuler update for sos