PT-2018-10080 · Ovirt · Ovirt Engine

Pedro Sampaio · Published 2018-06-12 · Updated 2023-02-13 · CVE-2018-1075

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ovirt-engine versions up to 4.2.3

Description The issue concerns an unfiltered password when choosing manual database provisioning. When engine-setup is run and manual database provisioning or connection to a remote database is chosen, the password input is logged in cleartext during the verification step. This could lead to inadvertent leakage of database passwords if the provisioning log is shared.

Recommendations For ovirt-engine versions up to 4.2.3, consider restricting access to the provisioning log to minimize the risk of password leakage. As a temporary workaround, avoid sharing the provisioning log until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Insertion into Log File

Weakness Enumeration

CWE-522

CWE-532

Related Identifiers

CVE-2018-1075

RHSA-2018:2071

Affected Products

Ovirt Engine

References · 6

• https://osv.dev/vulnerability/CVE-2018-1075 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2071 · Vendor Advisory
• https://gerrit.ovirt.org/#/c/91653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1075 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1075 · Note
• https://t.me/cvenotify/44212 · Telegram Post