CVE-2018-1072

Severity CVSS v4.0:
Pending analysis
Type:
CWE-532 Information Exposure Through Log Files
Publication date:
26/06/2018
Last modified:
09/10/2019

Description

ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provision*db", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database passwords.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:ovirt:ovirt:*:*:*:*:*:*:*:* 4.2.2 (excluding)
cpe:2.3:a:redhat:enterprise_virtualization_manager:4.2:*:*:*:*:*:*:*