CVE-2019-10194 Information disclosure in ovirt-engine-metrics
Attackers can read sensitive passwords from log files or playbooks if verbose logging is enabled, exposing credentials for oVirt Metrics deployments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-10194?
CVE-2019-10194 is a medium-severity vulnerability in Red Hat ovirt-engine-metrics, published on 11 Jul 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclosed in log files (if playbooks are run with -v) or in playbooks stored on Metrics or Bastion hosts.
Weakness: CWE-532
Which versions are affected by CVE-2019-10194?
It affects 2 products.
Linux distribution packages (1)
ovirt-engine-metrics Red Hat:rhev_manager:4.3 | All versions | 0:1.3.3.3-1.el7ev |
Products include Ovirt Ovirt, Redhat Virtualization Manager.
How do I fix CVE-2019-10194?
Apply the vendor's patch.
Is CVE-2019-10194 being exploited?
There is no known exploitation of CVE-2019-10194 in the wild and no public exploit code.
Other vulnerabilities in Red Hat ovirt-engine-metrics
Sources
Also known as GHSA-2rxg-f4r2-fm3c, RHSA-2019:2499.