Patchwire CVEs, their patch status, and feeds to follow them

CVE-2018-1062

Fixed in a distro release EPSS 1%

A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially sensitive data could be revealed to privileged users of that VM.

Published 2018-03-06 · CVE record · OSV

Products: oVirt

Distro releases

ReleasePackageFixed in
Red Hat rhev manager 4ovirt-engine0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-backend0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-dbscripts0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-extensions-api-impl0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-extensions-api-impl-javadoc0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-lib0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-restapi0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-setup0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-setup-base0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-setup-plugin-ovirt-engine0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-setup-plugin-ovirt-engine-common0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-setup-plugin-vmconsole-proxy-helper0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-setup-plugin-websocket-proxy0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-tools0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-tools-backup0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-userportal0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-vmconsole-proxy-helper0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-webadmin-portal0:4.1.9.1-0.1.el7
Red Hat rhev manager 4ovirt-engine-websocket-proxy0:4.1.9.1-0.1.el7
Red Hat rhev manager 4rhevm0:4.1.9.1-0.1.el7