CVE-2019-10183: Infoleak
Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option accepts guest VM password as command line arguments. Thus leaking them to others users on the system via process listing. It was introduced recently in the virt-manager v2.2.0 release.
Upstream patch: --------------- -> https://www.redhat.com/archives/virt-tools-list/2019-July/msg00014.html
Reference: ---------- -> https://virt-manager.org/download/ -> https://www.openwall.com/lists/oss-security/2019/07/03/1
Other sources
Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option accepts guest VM password as command line arguments, thus leaking them to others users on the system via process listing. It was introduced recently in the virt-manager v2.2.0 release.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10183?
CVE-2019-10183 is classified as a medium severity vulnerability.
How do I fix CVE-2019-10183?
To fix CVE-2019-10183, upgrade to the latest version of Red Hat Enterprise Linux or Redhat Virt-manager where the vulnerability is patched.
What causes CVE-2019-10183?
CVE-2019-10183 is caused by the 'virt-install' utility accepting guest VM passwords as command line arguments, which can expose them through process listing.
What software is affected by CVE-2019-10183?
CVE-2019-10183 affects Redhat Virt-manager version 2.2.0 and Red Hat Enterprise Linux version 8.0.
What happens if CVE-2019-10183 is exploited?
If exploited, CVE-2019-10183 could allow unauthorized users to view sensitive passwords used to create virtual machines.