CVE-2018-1075

CVSS 5 MEDIUMEPSS 0.4%CWE-532

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

12 jun 2018Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords.

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Produtos afetados

[UNKNOWN] · ovirt-engine

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://access.redhat.com/errata/RHSA-2018:2071 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1075 https://gerrit.ovirt.org/#/c/91653/