CVE-2022-2805
First published: Wed Apr 27 2022(Updated: )
A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with sufficient privileges to read the log file, leading to confidentiality loss.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/ovirt-engine | <0:4.5.3.2-1.el8e | 0:4.5.3.2-1.el8e |
| redhat/ovirt-engine-dwh | <0:4.5.7-1.el8e | 0:4.5.7-1.el8e |
| redhat/ovirt-engine-ui-extensions | <0:1.3.6-1.el8e | 0:1.3.6-1.el8e |
| redhat/ovirt-web-ui | <0:1.9.2-1.el8e | 0:1.9.2-1.el8e |
| Redhat Virtualization | =4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-2805?
CVE-2022-2805 is a vulnerability found in ovirt-engine that allows plaintext passwords to be logged in the log file when using otapi-style, leading to confidentiality loss.
How does CVE-2022-2805 affect the affected software?
CVE-2022-2805 affects the ovirt-engine package versions up to 4.5.3 and ovirt-engine-dwh, ovirt-engine-ui-extensions, and ovirt-web-ui packages versions up to 0:4.5.3.2-1.el8e and 0:1.3.6-1.el8e respectively, causing confidentiality loss.
What is the severity of CVE-2022-2805?
CVE-2022-2805 has a severity value of 6.5 (medium).
How can I fix CVE-2022-2805?
To fix CVE-2022-2805, upgrade the ovirt-engine package to version 4.5.3 or later, and upgrade the ovirt-engine-dwh, ovirt-engine-ui-extensions, and ovirt-web-ui packages to versions 0:4.5.3.2-1.el8e or later, 0:1.3.6-1.el8e or later, and 0:1.9.2-1.el8e or later respectively.
Where can I find more information about CVE-2022-2805?
You can find more information about CVE-2022-2805 in the following references: [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2022:8502), [CVE-2022-2805](https://access.redhat.com/security/cve/cve-2022-2805), [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2079545).
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-2805
- agent/software-canonical-lookup
- collector/redhat-cve
- vendor/redhat
- canonical/redhat virtualization
- version/redhat virtualization/4.0
- package-manager/redhat