CVE-2017-15113 Information disclosure in ovirt-engine
Attackers with log access can view unmasked passwords when debug logging is enabled, exposing sensitive credentials to unauthorized parties.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-15113?
CVE-2017-15113 is a high-severity vulnerability in Redhat Virtualization, published on 27 Jul 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to troubleshoot issues.
Which versions are affected by CVE-2017-15113?
It affects 2 products.
Linux distribution packages (20)
ovirt-engine Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-backend Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-dbscripts Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-extensions-api-impl Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-extensions-api-impl-javadoc Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-lib Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-restapi Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-setup Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-setup-base Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-setup-plugin-ovirt-engine Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-setup-plugin-ovirt-engine-common Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-setup-plugin-vmconsole-proxy-helper Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-setup-plugin-websocket-proxy Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-tools Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-tools-backup Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-userportal Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-vmconsole-proxy-helper Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-webadmin-portal Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
ovirt-engine-websocket-proxy Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
rhevm Red Hat:rhev_manager:4 | All versions | 0:4.1.7.6-0.1.el7 |
Products include Ovirt Ovirt, Redhat Virtualization.
How do I fix CVE-2017-15113?
Upgrade to a fixed version.
Is CVE-2017-15113 being exploited?
There is no known exploitation of CVE-2017-15113 in the wild and no public exploit code.
Other vulnerabilities in Redhat Virtualization
Sources
Also known as RHEA-2017:3138.