CVE-2022-2806 sosreport Exposure of Sensitive Information vulnerability
The oVirt log collector exposes the RHV admin password in unfiltered logs, allowing attackers with log access to steal credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-2806?
CVE-2022-2806 is a medium-severity vulnerability in ovirt-log-collector, published on 1 Sep 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev
Weakness: CWE-200
Which versions are affected by CVE-2022-2806?
3 open source packages ship an affected version, including sosreport. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
sosreport PyPI | All versions | 4.4 |
sosreport PyPI | All versions | 4.4 |
sosreport PyPI | All versions | 4.4 |
Products include Ovirt Log Collector, Sos Project Sos.
How do I fix CVE-2022-2806?
Upgrade sosreport to 4.4 or later.
Is CVE-2022-2806 being exploited?
There is no known exploitation of CVE-2022-2806 in the wild and no public exploit code.
Sources
Also known as AZL-10827, CLSA-2022-1665681071, CLSA-2026-1779212011, CLSA-2026-1779212122, CLSA-2026-1779296233, GHSA-7pf9-7cff-f854 and 5 more.