Description
Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclosed in log files (if playbooks are run with -v) or in playbooks stored on Metrics or Bastion hosts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | ovirt-engine-metrics | all versions | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | ovirt-engine-metrics | 1.3.3.3-1.el7ev | RHSA-2019:2499 |
Advisories 1
- RHSA-2019:2499 Red Hat Security Advisory: ovirt-engine-metrics security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10194
- 109140 vdb-entry
- RHSA-2019:2499 vendor-advisory