CVE-2018-1117 Information disclosure in ovirt-ansible-roles
Missing no_log directive in Ansible roles exposes admin passwords in logs, potentially leading to privilege escalation in shared environments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1117?
CVE-2018-1117 is a medium-severity vulnerability in [UNKNOWN] ovirt-ansible-roles, published on 19 Jun 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.
Weakness: CWE-532
Which versions are affected by CVE-2018-1117?
It affects 2 products.
Linux distribution packages (1)
ovirt-ansible-roles Red Hat:rhev_manager:4 | All versions | 0:1.0.6-1.el7ev |
Products include Ovirt Ovirt-Ansible-Roles, Redhat Enterprise Virtualization.
How do I fix CVE-2018-1117?
Upgrade to a fixed version.
Is CVE-2018-1117 being exploited?
There is no known exploitation of CVE-2018-1117 in the wild and no public exploit code.
Sources
Also known as GHSA-xghx-gh8p-84h2, RHSA-2018:1452.