Sensitive information in log files in Red Hat ovirt-engine
Priority LOW 34CWE-212Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-532.
Summary
ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to troubleshoot issues.
Why it matters now
EPSS 0.01149 67th percentileScored 2026-11-07
Fix Partial Red Hat: 1 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | ovirt-engine | 4.1.7.6 | — | No fix listed | CNA |
- ovirt-engine VendorRed Hat Affected 4.1.7.6 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Virtualization 3 | Affected | No fix planned: Will not fix |
| Red Hat Virtualization Manager 4.1 | Fixed | — |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-15113
References
More Red Hat Virtualization vulnerabilities
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
- TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
- TI-2021-02511 Incorrect authorization in polkit KEVCVSS 3.1HIGH 7.8
- TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
- TI-2015-00205 Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and… CVSS 2.0HIGH 10.0
Sources
- CVE-2017-15113 · CVE Program
- CVE-2017-15113 · NVD
- FIRST EPSS
- CVE-2017-15113 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences