Description
Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option accepts guest VM password as command line arguments, thus leaking them to others users on the system via process listing. It was introduced recently in the virt-manager v2.2.0 release.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | virt-install | from virt-manager v2.2.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | virt-manager | 1:3.2.0-3 | — |
| Ubuntu 20.04 LTS | virt-manager | 1:2.2.1-3ubuntu2.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | virt-install +2 | 2.2.1-2.el8 | RHSA-2019:3464 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | virt-manager | 3.2.0-10.1 | openSUSE-SU-2024:11500-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | virt-manager | 2.2.1-r0 | — |
| Alpine v3.23 | virt-manager | 2.2.1-r0 | — |
| Alpine v3.22 | virt-manager | 2.2.1-r0 | — |
| Alpine v3.21 | virt-manager | 2.2.1-r0 | — |
| Alpine v3.20 | virt-manager | 2.2.1-r0 | — |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | virt-manager | 2.2.1-r0 | — |
| Alpine v3.18 | virt-manager | 2.2.1-r0 | — |
| Alpine v3.17 | virt-manager | 2.2.1-r0 | — |
| Alpine v3.16 | virt-manager | 2.2.1-r0 | — |
| Alpine v3.15 | virt-manager | 2.2.1-r0 | — |
| Alpine v3.14 | virt-manager | 2.2.1-r0 | — |
| Alpine v3.13 | virt-manager | 2.2.1-r0 | — |
| Alpine v3.12 | virt-manager | 2.2.1-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | virt-install +2 | 2.2.1-2.0.1.el8 | ELSA-2019-3464 |
Advisories 3
- openSUSE-SU-2024:11500-1 virt-install-3.2.0-10.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2019:3464 Red Hat Security Advisory: virt-manager security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2019-3464 Low: virt-manager security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 14, 2019
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10183
- 109027 vdb-entry
- RHSA-2019:3464 vendor-advisory