{"id":"CVE-2022-2806","aliases":["AZL-10827","CLSA-2022-1665681071","CLSA-2026-1779212011","CLSA-2026-1779212122","CLSA-2026-1779296233","EUVD-2022-6735","GHSA-7pf9-7cff-f854","MGASA-2022-0373","OESA-2024-1564","PYSEC-2026-925","RHSA-2022:6393","UBUNTU-CVE-2022-2806","USN-5636-1"],"status":"published","title":"sosreport Exposure of Sensitive Information vulnerability","description":"It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00251,"percentile":0.16707,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2022-09-01T19:58:50Z","modified":"2026-10-26T09:31:41Z","fixes":[{"ecosystem":"PyPI","package":"sosreport","fixed_in":["4.4"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"sos","fixed_in":["4.4-1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"sosreport","fixed_in":["3.9.1-1ubuntu0.16.04.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"sos","fixed_in":["3.9-5.el7.12.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"sos","fixed_in":["3.9-5.el7_9.12.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"sos","fixed_in":["3.9-5.0.30.el7_9.10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"sos","fixed_in":["4.4-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"sos","fixed_in":["3.8-4.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"sos","fixed_in":["3.8-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"sos","fixed_in":["4.0-6.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"sos","fixed_in":["4.0-6.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"sos","fixed_in":["4.0-6.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"sos","fixed_in":["4.0-6.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"sosreport","fixed_in":["3.5-1~ubuntu14.04.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sosreport","fixed_in":["3.9.1-1ubuntu0.16.04.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"sosreport","fixed_in":["4.3-1ubuntu0.18.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"sosreport","fixed_in":["4.3-1ubuntu0.20.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"sosreport","fixed_in":["4.3-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"sosreport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"sos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4-1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"sosreport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.1-1ubuntu0.16.04.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"sos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9-5.el7.12.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"sos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9-5.el7_9.12.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"sos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9-5.0.30.el7_9.10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"sosreport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4"}]}],"versions":["3.2","3.2.0a1"]},{"source":"osv","ecosystem":"Mageia:8","package":"sos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"sos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8-4.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"sos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"sos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-6.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"sos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-6.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"sos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-6.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"sos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-6.oe2203sp3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"sosreport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4"}]}],"versions":["3.2","3.2.0a1"]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-dbscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-health-check-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-restapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-cinderlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-imageio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-ovirt-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-ovirt-engine-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-vmconsole-proxy-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-websocket-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-tools-backup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-vmconsole-proxy-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-webadmin-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-websocket-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"python3-ovirt-engine-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"rhvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.2.4-0.1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.1-1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-log-collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.7-2.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-ui-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.5-1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"sosreport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5-1~ubuntu14.04.3+esm1"}]}],"versions":["3.0-1","3.1-1","3.1-1ubuntu1","3.1-1ubuntu2","3.1-1ubuntu2.1","3.1-1ubuntu2.2","3.4-1~ubuntu14.04.1","3.5-1~ubuntu14.04.2","3.5-1~ubuntu14.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sosreport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.1-1ubuntu0.16.04.2+esm1"}]}],"versions":["3.2-2ubuntu1","3.2+git276-g7da50d6-1","3.2+git276-g7da50d6-2","3.2+git276-g7da50d6-3","3.2+git276-g7da50d6-3build1","3.2+git276-g7da50d6-3ubuntu1","3.4-1~ubuntu16.04.1","3.5-1~ubuntu16.04.2","3.5-1~ubuntu16.04.3","3.6-1ubuntu0.16.04.2","3.6-1ubuntu0.16.04.3","3.6-1ubuntu0.16.04.4","3.9-1ubuntu0.16.04.1","3.9-1ubuntu0.16.04.2","3.9.1-1ubuntu0.16.04.1","3.9.1-1ubuntu0.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sosreport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-1ubuntu0.18.04.2"}]}],"versions":["3.4-1","3.5-1","3.5-1ubuntu1","3.5-1ubuntu2","3.5-1ubuntu3","3.5-1ubuntu3.18.04.1","3.6-1ubuntu0.18.04.2","3.6-1ubuntu0.18.04.3","3.6-1ubuntu0.18.04.4","3.9-1ubuntu0.18.04.1","3.9-1ubuntu0.18.04.2","3.9-1ubuntu0.18.04.3","3.9.1-1ubuntu0.18.04.1","3.9.1-1ubuntu0.18.04.2","3.9.1-1ubuntu0.18.04.3","4.1-1ubuntu0.18.04.1","4.1-1ubuntu0.18.04.2","4.1-1ubuntu0.18.04.3","4.3-1ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sosreport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-1ubuntu0.20.04.2"}]}],"versions":["3.6-1ubuntu3","3.8-1ubuntu1","3.8-1ubuntu2","3.8-1ubuntu3","3.9-1ubuntu1","3.9-1ubuntu2","3.9-1ubuntu2.1","3.9.1-1ubuntu0.20.04.1","3.9.1-1ubuntu0.20.04.2","4.0-1~ubuntu0.20.04.1","4.0-1~ubuntu0.20.04.2","4.0-1~ubuntu0.20.04.3","4.1-1ubuntu0.20.04.1","4.1-1ubuntu0.20.04.2","4.1-1ubuntu0.20.04.3","4.2-1ubuntu0.20.04.1","4.3-1ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sosreport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-1ubuntu2.1"}]}],"versions":["4.1-1ubuntu2","4.1-1ubuntu3","4.2-1ubuntu2","4.3-1ubuntu1","4.3-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"sosreport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5-1~ubuntu14.04.3+esm1"}]}],"versions":["3.0-1","3.1-1","3.1-1ubuntu1","3.1-1ubuntu2","3.1-1ubuntu2.1","3.1-1ubuntu2.2","3.4-1~ubuntu14.04.1","3.5-1~ubuntu14.04.2","3.5-1~ubuntu14.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sosreport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.1-1ubuntu0.16.04.2+esm1"}]}],"versions":["3.2-2ubuntu1","3.2+git276-g7da50d6-1","3.2+git276-g7da50d6-2","3.2+git276-g7da50d6-3","3.2+git276-g7da50d6-3build1","3.2+git276-g7da50d6-3ubuntu1","3.4-1~ubuntu16.04.1","3.5-1~ubuntu16.04.2","3.5-1~ubuntu16.04.3","3.6-1ubuntu0.16.04.2","3.6-1ubuntu0.16.04.3","3.6-1ubuntu0.16.04.4","3.9-1ubuntu0.16.04.1","3.9-1ubuntu0.16.04.2","3.9.1-1ubuntu0.16.04.1","3.9.1-1ubuntu0.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sosreport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-1ubuntu0.18.04.2"}]}],"versions":["3.4-1","3.5-1","3.5-1ubuntu1","3.5-1ubuntu2","3.5-1ubuntu3","3.5-1ubuntu3.18.04.1","3.6-1ubuntu0.18.04.2","3.6-1ubuntu0.18.04.3","3.6-1ubuntu0.18.04.4","3.9-1ubuntu0.18.04.1","3.9-1ubuntu0.18.04.2","3.9-1ubuntu0.18.04.3","3.9.1-1ubuntu0.18.04.1","3.9.1-1ubuntu0.18.04.2","3.9.1-1ubuntu0.18.04.3","4.1-1ubuntu0.18.04.1","4.1-1ubuntu0.18.04.2","4.1-1ubuntu0.18.04.3","4.3-1ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sosreport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-1ubuntu0.20.04.2"}]}],"versions":["3.6-1ubuntu3","3.8-1ubuntu1","3.8-1ubuntu2","3.8-1ubuntu3","3.9-1ubuntu1","3.9-1ubuntu2","3.9-1ubuntu2.1","3.9.1-1ubuntu0.20.04.1","3.9.1-1ubuntu0.20.04.2","4.0-1~ubuntu0.20.04.1","4.0-1~ubuntu0.20.04.2","4.0-1~ubuntu0.20.04.3","4.1-1ubuntu0.20.04.1","4.1-1ubuntu0.20.04.2","4.1-1ubuntu0.20.04.3","4.2-1ubuntu0.20.04.1","4.3-1ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sosreport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-1ubuntu2.1"}]}],"versions":["4.1-1ubuntu2","4.1-1ubuntu3","4.2-1ubuntu2","4.3-1ubuntu1","4.3-1ubuntu2"]}],"products":[{"vendor":"ovirt","product":"log_collector"},{"vendor":"sos_project","product":"sos"}],"references":[{"url":"https://github.com/sosreport/sos/pull/2947","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2806","tags":["web","advisory"]},{"url":"https://github.com/sosreport/sos/commit/5fd872c64c53af37015f366295e0c2418c969757","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7pf9-7cff-f854","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2022-1665681071","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1779212011.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1779212122.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1779296233.html","tags":["advisory"]},{"url":"https://github.com/sosreport/sos","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2022-0373.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30898","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5636-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1564","tags":["advisory"]},{"url":"https://pypi.org/project/sosreport","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6393","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1828406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1939284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944286","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1955388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1974974","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034584","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080005","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2092478","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2094577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2097536","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2097558","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2097560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2097725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104115","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104831","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104939","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105075","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107250","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107267","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109923","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6393.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11022","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11022","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11022","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gxr4-xjj5-5px2","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11023","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11023","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11023","tags":["advisory"]},{"url":"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22096","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22096","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22096","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23358","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23358","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23358","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2806","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2806","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-31129","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31129","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31129","tags":["advisory"]},{"url":"https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2022-2806","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-2806","description":"It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev","status":"published","published":"2022-09-01T19:58:50Z","modified":"2024-08-03T00:52:59.579Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:32.843656Z"}],"euvd":[{"id":"EUVD-2022-6735","description":"It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev","status":"published","published":"2022-09-01T19:58:50Z","modified":"2024-08-03T00:52:59Z","updated_at":"2026-11-03T03:25:57.460299Z"}],"ghsa":[{"id":"GHSA-7pf9-7cff-f854","title":"sosreport Exposure of Sensitive Information vulnerability","description":"It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev","status":"published","published":"2022-09-02T00:01:01Z","modified":"2024-04-08T19:03:05Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:42.744468Z"}],"nvd":[{"id":"CVE-2022-2806","description":"It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev","status":"published","published":"2022-09-01T21:15:09.86Z","modified":"2026-06-17T04:42:37.177Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:07:26.802986Z"}],"osv":[{"id":"AZL-10827","title":"CVE-2022-2806 affecting package sos for versions less than 4.4-1","description":"It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev","status":"published","published":"2022-09-01T21:15:09Z","modified":"2026-04-21T04:21:34.120508Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"GHSA-7pf9-7cff-f854","title":"sosreport Exposure of Sensitive Information vulnerability","description":"It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev","status":"published","published":"2022-09-02T00:01:01Z","modified":"2026-07-07T11:56:29.825594692Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"OESA-2024-1564","title":"sos security update","description":"Sos is an extensible, portable, support data collection tool primarily aimed at Linux distributions and other UNIX-like operating systems.\r\n\r\nSecurity Fix(es):\r\n\r\nIt was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev(CVE-2022-2806)","status":"published","published":"2024-05-10T11:07:01Z","modified":"2026-08-18T01:18:24.849954185Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"PYSEC-2026-925","title":"sosreport Exposure of Sensitive Information vulnerability","description":"It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev","status":"published","published":"2026-07-06T08:03:32.275629Z","modified":"2026-07-07T11:45:51.077674573Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"RHSA-2022:6393","title":"Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.2] bug fix and security update","status":"published","published":"2024-09-30T14:25:44Z","modified":"2026-10-13T10:03:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"UBUNTU-CVE-2022-2806","description":"It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev","status":"published","published":"2022-09-01T21:15:00Z","modified":"2026-02-04T04:35:38.646703Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"CLSA-2022-1665681071","title":"Fix CVE(s): CVE-2022-2806","description":"\n   * SECURITY UPDATE: Exposed sensitive information\n     - debian/patches/CVE-2022-2806.patch: filter out all password keys\n       in sos/report/plugins/ovirt.py\n     - CVE-2022-2806","status":"published","published":"2022-10-13T17:11:11Z","modified":"2026-06-04T10:03:24.890695Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2026-1779212011","title":"sos: Fix of CVE-2022-2806","description":"- CVE-2022-2806: ovirt plugin: filter out all password keys in answer files","status":"published","published":"2026-05-21T10:32:11Z","modified":"2026-10-26T09:31:41.049397829Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779212122","title":"sos: Fix of CVE-2022-2806","description":"- CVE-2022-2806: ovirt plugin: filter out all password keys in answer files","status":"published","published":"2026-05-19T17:35:26Z","modified":"2026-06-01T00:33:28.374971719Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779296233","title":"sos: Fix of CVE-2022-2806","description":"- CVE-2022-2806: ovirt plugin: filter out all password keys in answer files","status":"published","published":"2026-05-20T16:57:17Z","modified":"2026-06-01T00:33:27.408818361Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"MGASA-2022-0373","title":"Updated sos packages fix security vulnerability","description":"SoS incorrectly handled certain data. An attacker could possibly use this\nissue to expose sensitive information. (CVE-2022-2806)\n","status":"published","published":"2022-10-18T23:14:56Z","modified":"2026-04-16T04:42:57.055160997Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"USN-5636-1","title":"sosreport vulnerability","description":"It was discovered that SoS incorrectly handled certain data.\nAn attacker could possibly use this issue to expose sensitive information.\n","status":"published","published":"2022-09-26T10:23:36Z","modified":"2026-06-29T13:49:41.492862418Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}