Description
It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges (eg Basic Operations) could exploit this flaw to delete disks attached to guests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ovirt-engine | 4.3.2.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | rhvm +19 | 4.2.8.7-0.1.el7ev | RHBA-2019:0802 |
Advisories 1
- RHBA-2019:0802 Red Hat Bug Fix Advisory: Red Hat Virtualization Manager (ovirt-engine) 4.2.8 Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3879
- 107561 vdb-entry
- RHBA-2019:0802 vendor-advisory