Description
ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ovirt-engine | ovirt-engine 4.2.2.5, ovirt-engine 4.1.11.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | rhevm +19 | 4.1.11.2-0.1.el7 | RHBA-2018:1219 |
Advisories 1
- RHBA-2018:1219 Red Hat Bug Fix Advisory: Red Hat Virtualization Manager (ovirt-engine) 4.1.11 Red Hat Security Advisories (RHSA) · Jul 1, 2026