CVE-2018-1075 ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect t...
HighCVSS 7.8
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ovirt | < 4.2.3 | 4.2.3 |
| [UNKNOWN] ovirt-engine | = up to ovirt-engine 4.2.3 | No fix listed |
References
- RHSA-2018:2071 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- gerrit.ovirt.org vendor-advisory