sos-collector-1.5-3.el7

sos-collector is a utility that gathers sosreports from multi-node environments. sos-collector facilitates data collection for support cases and it can be run from either a node or from an administrator's local workstation that has network access to the environment.

The following packages have been upgraded to a later upstream version: sos-collector (1.5). (BZ#1644776)

Security Fix(es):

* sos-collector: incorrect permissions set on newly created files (CVE-2018-14650)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

This issue was discovered by Riccardo Schirone (Asianux Product Security).

CVE-2018-14650
It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the /var/tmp directory.