TI-2013-03826 Aliases CVE-2013-4367 GHSA-7rjr-g954-m9f4

Incorrect permission assignment in ovirt-engine

LOW 34CWE-732Published 2019-11-01 · Updated 2024-08-06

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's os.chmod() works when passed a mode of '-1'.

Why it matters now

EPSS 0.00323 25th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ovirt-engine	ovirt-engine	ovirt-engine 3.2 running on Linux kernel 3.1 and newer	—	No fix listed	CNA

ovirt-engine Vendorovirt-engine Affected ovirt-engine 3.2 running on Linux kernel 3.1 and newer Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:ovirt:ovirt-engine:3.2:::::::*	3.2	Vulnerable	oVirt
cpe:2.3:o:linux:linux_kernel:3.1:::::::*	3.1	Running on	Linux

cpe:2.3:a:ovirt:ovirt-engine:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·oVirt
cpe:2.3:o:linux:linux_kernel:3.1:*:*:*:*:*:*:* Versions 3.1 Running on ·Linux

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2013-4367
2026-10-03 Alias added: GHSA-7rjr-g954-m9f4

References

Patch 1

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4367

Advisory 1

https://access.redhat.com/security/cve/cve-2013-4367

TI-2022-00753 A flaw was found in the way the "flags" member of the new pipe buffer structure was… KEVCVSS 3.1HIGH 7.8
TI-2024-00759 Ovirt: authentication bypass CVSS 3.1HIGH 7.5
TI-2020-18019 Improper access control in ovirt-engine CVSS 3.1MEDIUM 6.5
TI-2020-11204 Cross-site scripting in ovirt-engine CVSS 3.1MEDIUM 6.3
TI-2019-13948 Cross-site scripting in Red Hat ovirt-engine CVSS 3.1MEDIUM 6.1
TI-2022-02948 Cross-site scripting in ovirt-engine CVSS 3.1MEDIUM 6.1

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences