id: PYSEC-2017-72
details: sosreport 3.2 uses weak permissions for generated sosreport archives, which
  allows local users with access to /var/tmp/ to obtain sensitive information by reading
  the contents of the archive.
affected:
- package:
    name: sosreport
    ecosystem: PyPI
    purl: pkg:pypi/sosreport
  ranges:
  - type: GIT
    repo: https://github.com/sosreport/sos
    events:
    - introduced: "0"
    - fixed: d7759d3ddae5fe99a340c88a1d370d65cfa73fd6
  - type: ECOSYSTEM
    events:
    - introduced: "3.0"
  versions:
  - "3.2"
  - 3.2.0a1
references:
- type: FIX
  url: https://github.com/sosreport/sos/commit/d7759d3ddae5fe99a340c88a1d370d65cfa73fd6
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=1218658
- type: ADVISORY
  url: https://github.com/advisories/GHSA-gw46-8559-cggp
aliases:
- CVE-2015-3171
- GHSA-gw46-8559-cggp
modified: "2021-07-25T23:34:55.539428Z"
published: "2017-07-25T18:29:00Z"