Description
ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provision*db", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database passwords.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | ovirt-engine-setup | oVirt 4.2.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | rhvm +19 | 4.2.4.5-0.1.el7_3 | RHSA-2018:2071 |
Advisories 1
- RHSA-2018:2071 Red Hat Security Advisory: Red Hat Virtualization Manager security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026