CVE-2018-1075

low-risk

Published 2018-06-12

ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords.

Do I need to act?

0.04% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.0/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Ovirt

Affected Vendors

Ovirt

References (6)

Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2071

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1075

Vendor Advisory https://gerrit.ovirt.org/#/c/91653/

Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2071

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1075

Vendor Advisory https://gerrit.ovirt.org/#/c/91653/

/ 100

low-risk

Severity 17/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal