CVE-2019-10139 Information disclosure in cockpit-ovirt
The cockpit-ovirt plugin stores admin and appliance passwords in plain text during deployment, allowing local attackers to read sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10139?
CVE-2019-10139 is a medium-severity vulnerability in cockpit-ovirt, published on 17 May 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted.
Which versions are affected by CVE-2019-10139?
It affects 1 product.
Linux distribution packages (2)
cockpit-ovirt Red Hat:enterprise_linux:7::hypervisor | All versions | 0:0.13.5-1.el7ev |
cockpit-ovirt-dashboard Red Hat:enterprise_linux:7::hypervisor | All versions | 0:0.13.5-1.el7ev |
Products include Ovirt Cockpit-Ovirt.
How do I fix CVE-2019-10139?
Apply the vendor's patch.
Is CVE-2019-10139 being exploited?
There is no known exploitation of CVE-2019-10139 in the wild and no public exploit code.
Sources
Also known as GHSA-35c5-8h9g-6345, RHSA-2019:2433.