Description
ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | ovirt-engine | up to ovirt-engine 4.2.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | rhvm +19 | 4.2.4.5-0.1.el7_3 | RHSA-2018:2071 |
Advisories 1
- RHSA-2018:2071 Red Hat Security Advisory: Red Hat Virtualization Manager security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026