PT-2017-8958 · Ovirt · Ovirt Engine

Jiri Belka + 1 · Publicado 2017-08-22 · Atualizado 2017-08-30 · CVE-2016-6310

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions oVirt Engine versions prior to 4.0

Description The issue concerns the disclosure of sensitive information, specifically the ENGINE HTTPS PKI TRUST STORE PASSWORD, which is logged in the /var/log/ovirt-engine/engine.log file. This affects oVirt Engine in RHEV before version 4.0.

Recommendations For versions prior to 4.0, update to version 4.0 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-6310

Produtos afetados

Ovirt Engine

Referências · 4

• http://securityfocus.com/bid/92345 · Nota
• https://osv.dev/vulnerability/CVE-2016-6310 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1363738 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-6310 · Nota de Segurança