CVE-2018-1072 Information disclosure in ovirt-engine-setup
Attackers can obtain database credentials if provisioning logs are shared, as passwords were logged in cleartext during specific backup operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1072?
CVE-2018-1072 is a medium-severity vulnerability in [UNKNOWN] ovirt-engine-setup, published on 26 Jun 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provision*db", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database passwords.
Weakness: CWE-532
Which versions are affected by CVE-2018-1072?
It affects 2 products.
Products include Ovirt Ovirt, Redhat Enterprise Virtualization Manager.
How do I fix CVE-2018-1072?
Upgrade to a fixed version.
Is CVE-2018-1072 being exploited?
There is no known exploitation of CVE-2018-1072 in the wild and no public exploit code.
Other vulnerabilities in [UNKNOWN] ovirt-engine-setup
Sources
Also known as GHSA-9fw7-mcq9-ghf3.