CVE-2018-1072: Critical severity ovirt vulnerability
ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provisiondb", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database passwords.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1072?
The severity of CVE-2018-1072 is critical with a score of 9.8.
Which software versions are affected by CVE-2018-1072?
ovirt-engine version up to exclusive 4.2.2 and Redhat Enterprise Virtualization Manager version 4.2 are affected by CVE-2018-1072.
How does CVE-2018-1072 expose information?
CVE-2018-1072 exposes information through log files.
How can I fix CVE-2018-1072?
To fix CVE-2018-1072, update ovirt-engine to version 4.2.2 or later, and update Redhat Enterprise Virtualization Manager to version 4.2.
Where can I find more information about CVE-2018-1072?
You can find more information about CVE-2018-1072 in the following references: [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2018:2071) and [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1072).