CVE-2022-2806

What it actually does

The ovirt-log-collector and sosreport tools capture the RHV administrator password in plaintext without filtering or redaction when generating diagnostic reports or logs.

Why it matters to the business

Organizations using affected versions risk exposing privileged credentials in support bundles or log files, which can lead to unauthorized administrative access and broader system compromise if those files are shared or stored insecurely.

How an attack unfolds

An attacker with local access or the ability to retrieve generated sosreport/ovirt-log-collector archives inspects the unfiltered output to extract the RHV admin password directly, enabling further lateral movement or privilege escalation without needing additional credentials.

How to fix it

Upgrade sos to version 4.2-20.el8_6 or newer and ovirt-log-collector to 4.4.7-2.el8ev or newer on all affected systems; regenerate any previously created reports after patching to ensure credentials are no longer present.

How to confirm the fix worked

Verify package versions match or exceed the fixed releases using rpm -q; inspect newly generated reports to confirm the administrator password is absent or redacted; re-run sosreport/ovirt-log-collector on test systems and search output for credential patterns.

Typical attack path

1. Obtain access to a system running the vulnerable sos or ovirt-log-collector package
2. Trigger or wait for a diagnostic report generation via sosreport or ovirt-log-collector
3. Locate the resulting archive or log files on disk or in transit
4. Search the contents for the unfiltered administrator password string
5. Use the extracted password to authenticate to RHV management interfaces

How to detect it

Search system logs, file system paths containing sosreport or ovirt-log-collector archives, and any shared support bundles for plaintext credential strings; review command history for sosreport invocations and examine resulting tarballs or text files for unfiltered password entries.

• /var/tmp/sosreport*
• ovirt-log-collector*.tar
• RHV admin password
• password=.* in sosreport output

What your security team should do

• Immediately inventory all hosts running sos or ovirt-log-collector and schedule upgrades to the fixed versions
• Audit existing diagnostic archives for exposed passwords and rotate any discovered credentials
• Implement file permissions and access controls on report storage locations to limit exposure
• Add automated scanning of generated reports for sensitive data before sharing with vendors