Read the docs
TI-2018-00995 Aliases CVE-2018-1075GHSA-2874-9wc2-224f

Sensitive information in log files in [UNKNOWN] ovirt-engine

Priority LOW 34CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-532.

Summary

ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords.

Why it matters now

EPSS 0.00348 28th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]ovirt-engineup to ovirt-engine 4.2.3—No fix listedCNA
  • ovirt-engine Vendor[UNKNOWN] Affected up to ovirt-engine 4.2.3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ovirt:ovirt:*:*:*:*:*:*:*:*before 4.2.3VulnerableoVirt
  • cpe:2.3:a:ovirt:ovirt:*:*:*:*:*:*:*:* Versions before 4.2.3 Vulnerable ·oVirt

Remediation

Red Hat 1 advisory

  • RHSA-2018:2071 Released 2018-06-27 · Red Hat rating Moderate
    Red Hat Virtualization Manager security, bug fix, and enhancement update
    • RHV-M 4.2 ovirt-engine-4.2.4.5-0.1.el7_3, ovirt-engine-backend-4.2.4.5-0.1.el7_3, ovirt-engine-dbscripts-4.2.4.5-0.1.el7_3 +17

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHV-M 4.2Fixed RHSA-2018:2071

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1075
  2. 2026-10-03 Alias added: GHSA-2874-9wc2-224f

References

Advisory 3

  • TI-2018-00992 Sensitive information in log files in [UNKNOWN] ovirt-engine-setup CVSS 3.0CRITICAL 9.8
  • TI-2019-02889 Missing authorization in ovirt-engine CVSS 3.1HIGH 8.1
  • TI-2018-00994 Information disclosure in ovirt-engine CVSS 3.0HIGH 7.7
  • TI-2014-06524 oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the… CVSS 3.0HIGH 7.5
  • TI-2017-11085 Sensitive information in log files in Red Hat ovirt-engine CVSS 3.0HIGH 7.2
  • TI-2014-00146 Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier… CVSS 2.0MEDIUM 6.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences