Description
During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ovirt | cockpit-ovirt | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | cockpit-ovirt +1 | 0.13.5-1.el7ev | RHSA-2019:2433 |
| RHEL 7 | imgbased +1 | 1.1.9-0.1.el7ev | RHSA-2019:2437 |
| RHEL 7 | ovirt-node-ng +2 | 4.3.5-0.20190717.0.el7ev | RHSA-2019:2437 |
| RHEL 7 | redhat-release-virtualization-host +1 | 4.3.5-2.el7ev | RHSA-2019:2437 |
| RHEL 7 | redhat-virtualization-host +1 | 4.3.5-20190722.0.el7_7 | RHSA-2019:2437 |
Advisories 2
- RHSA-2019:2437 Red Hat Security Advisory: Red Hat Virtualization security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2019:2433 Red Hat Security Advisory: cockpit-ovirt security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10139
- 108396 vdb-entry
- RHSA-2019:2433 vendor-advisory
- RHSA-2019:2437 vendor-advisory