CVE-2019-10139 During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file /var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var which contains the admin and the appliance....
HighCVSS 7.8
EPSS 0.25%
- Published
- Updated
- Exploit status
- No public exploit known
Description
During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file /var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ovirt cockpit-ovirt | All versions | No fix listed |
References
- 108396 third-party-advisory vdb-entry
- RHSA-2019:2433 third-party-advisory vendor-advisory
- RHSA-2019:2437 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory