Description
ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | ovirt-ansible-roles | ovirt-ansible-roles 1.0.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | ovirt-ansible-roles | 1.0.6-1.el7ev | RHSA-2018:1452 |
Advisories 1
- RHSA-2018:1452 Red Hat Security Advisory: ovirt-ansible-roles security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1117
- 104186 vdb-entry
- RHSA-2018:1452 vendor-advisory