CVE-2017-15113
First published: Fri Jul 27 2018(Updated: )
ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to troubleshoot issues.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.ovirt.engine.sdk:ovirt-engine-sdk-java | <4.1.7.6 | 4.1.7.6 |
| Ovirt Ovirt | <4.1.7.6 | |
| Redhat Virtualization | =4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2017-15113
- https://access.redhat.com/errata/RHEA-2017:3138
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15113
- https://gerrit.ovirt.org/gitweb?p=ovirt-engine.git;a=commitdiff;h=f4a5d0cc772127dbfe40789e26c4633ceea07d14;hp=e6e8704ac9eb115624ff66e2965877d8e63a45f4
- https://web.archive.org/web/20210124121521/https://www.securityfocus.com/bid/101933/
- https://github.com/advisories/GHSA-m833-87vf-576c (Advisory)
- http://www.securityfocus.com/bid/101933
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2017-15113.
What is the severity of CVE-2017-15113?
The severity of CVE-2017-15113 is high with a CVSS score of 6.6.
Which software versions are affected by CVE-2017-15113?
ovirt-engine before version 4.1.7.6 is affected by CVE-2017-15113.
What is the risk associated with CVE-2017-15113?
The risk associated with CVE-2017-15113 is that passwords are included in the log file without masking, which can pose a risk if debug-level logs are shared with vendors or other parties.
How can I fix CVE-2017-15113?
To fix CVE-2017-15113, upgrade ovirt-engine to version 4.1.7.6 or higher.
- collector/nvd-cve
- collector/nvd-index
- collector/github-advisory
- alias/GHSA-m833-87vf-576c
- alias/CVE-2017-15113
- collector/github-advisory-latest
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- vendor/ovirt
- canonical/ovirt ovirt
- vendor/redhat
- canonical/redhat virtualization
- version/redhat virtualization/4.1
- package-manager/maven