Description
cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | cfme | 5.10.4.3 and below, 5.9.9.3 and below | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat CloudForms 5 | ansible-tower +5 | 3.5.1-1.el7at | RHSA-2019:2466 |
| Red Hat CloudForms 5 | cfme +5 | 5.10.8.0-1.el7cf | RHSA-2019:2466 |
| Red Hat CloudForms 5 | rubygem-nokogiri +1 | 1.8.5-1.el7cf | RHSA-2019:2466 |
Advisories 1
- RHSA-2019:2466 Red Hat Security Advisory: CloudForms 4.7.8 security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Feb 21, 2026