Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tODMzLTg3dmYtNTc2Y84AARgZ

ovirt-engine Logs Plaintext Passwords To File

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to troubleshoot issues.

Permalink: https://github.com/advisories/GHSA-m833-87vf-576c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tODMzLTg3dmYtNTc2Y84AARgZ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: over 1 year ago

Widthdrawn: over 1 year ago

CVSS Score: 6.6
CVSS vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.00277
EPSS Percentile: 0.68524

Identifiers: GHSA-m833-87vf-576c, CVE-2017-15113
References:

• https://nvd.nist.gov/vuln/detail/CVE-2017-15113
• https://access.redhat.com/errata/RHEA-2017:3138
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15113
• https://gerrit.ovirt.org/gitweb?p=ovirt-engine.git;a=commitdiff;h=f4a5d0cc772127dbfe40789e26c4633ceea07d14;hp=e6e8704ac9eb115624ff66e2965877d8e63a45f4
• https://web.archive.org/web/20210124121521/https://www.securityfocus.com/bid/101933/
• https://github.com/advisories/GHSA-m833-87vf-576c

Blast Radius: 5.6

Affected Packages