Description
A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with sufficient privileges to read the log file, leading to confidentiality loss.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ovirt-engine | ovirt-engine 4.5.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | ovirt-engine-dwh +2 | 4.5.7-1.el8ev | RHSA-2022:8502 |
| Red Hat Rhev Manager 4 | ovirt-engine-ui-extensions | 1.3.6-1.el8ev | RHSA-2022:8502 |
| Red Hat Rhev Manager 4 | ovirt-web-ui | 1.9.2-1.el8ev | RHSA-2022:8502 |
| Red Hat Rhev Manager 4 | rhvm +19 | 4.5.3.2-1.el8ev | RHSA-2022:8502 |
Advisories 1
- RHSA-2022:8502 Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.3] bug fix and security update Red Hat Security Advisories (RHSA) · Sep 15, 2026