5.0 Medium

CVE-2018-1075 ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning

Description

ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords.

Affected products and versions

Product	Affected versions	Fixed in
ovirt-engine	Versions not published

The 2 CVEs of ovirt-engine →

CVE-2018-1073 The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and… 5.3 Medium

Do you use ovirt-engine?

Track this CVE Watch ovirt-engine Check my SBOMs

www.cveye.io/en/cve/CVE-2018-1075

Timeline

Published June 12, 2018
Last modified August 5, 2024

References

bugzilla.redhat.com bugzilla.redhat.com
gerrit.ovirt.org gerrit.ovirt.org
RHSA-2018:2071 access.redhat.com

Track this CVE

CVE-2018-1075 ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning

Description

Affected products and versions

Other CVEs of ovirt-engine