PT-2017-8958 · Ovirt · Ovirt Engine

Jiri Belka + 1 · Published 2017-08-22 · Updated 2017-08-30 · CVE-2016-6310

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions oVirt Engine versions prior to 4.0

Description The issue concerns the disclosure of sensitive information, specifically the ENGINE HTTPS PKI TRUST STORE PASSWORD, which is logged in the /var/log/ovirt-engine/engine.log file. This affects oVirt Engine in RHEV before version 4.0.

Recommendations For versions prior to 4.0, update to version 4.0 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-6310

Affected Products

Ovirt Engine

References · 4

• https://osv.dev/vulnerability/CVE-2016-6310 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1363738 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6310 · Security Note
• http://securityfocus.com/bid/92345 · Note