CVE-2018-1072
Fixed in a distro release EPSS <1%CVSS 5.0
ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provision*db", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database passwords.
Products: ovirt, redhat enterprise_virtualization_manager
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat rhev manager 4.2 | ovirt-engine | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-backend | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-dbscripts | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-extensions-api-impl | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-extensions-api-impl-javadoc | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-health-check-bundler | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-lib | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-restapi | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-setup | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-setup-base | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-setup-plugin-ovirt-engine | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-setup-plugin-ovirt-engine-common | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-setup-plugin-vmconsole-proxy-helper | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-setup-plugin-websocket-proxy | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-tools | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-tools-backup | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-vmconsole-proxy-helper | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-webadmin-portal | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | ovirt-engine-websocket-proxy | 0:4.2.4.5-0.1.el7_3 |
| Red Hat rhev manager 4.2 | rhvm | 0:4.2.4.5-0.1.el7_3 |