303 matches found
CVE-2014-0161
The CVE-2014-0161 issue affects ovirt-engine-sdk-python prior to 3.4.0.7 and 3.5.0.4, where the client does not verify that the remote host’s certificate hostname matches the CN or subjectAltName in the TLS/SSL certificate. This incomplete hostname validation can enable man-in-the-middle attacks ...
CVE-2014-0161: Improper Certificate Validation
ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name CN or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an...
Unspecified vulnerability in ovirt-engine
ovirt-engine is an open source virtualization management engine. A security vulnerability exists in ovirt-engine version 3.2 running on Linux kernel 3.1 and later, which can be exploited by attackers to read files...
CVE-2013-4367
ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's os.chmod works when passed a mode of '-1'...
Code injection
ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's os.chmod works when passed a mode of '-1'...
CVE-2013-4367
ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's os.chmod works when passed a mode of '-1'...
CVE-2013-4367
CVE-2013-4367 affects ovirt-engine 3.2 running on Linux kernel 3.1 and newer, where upstream kernel behavior change with os.chmod(-1) causes certain files to become world-writable. This is a local attacker issue with potential exposure of sensitive data, as reflected by CVSS metrics (NVD CVSSv3.1...
CVE-2013-4367: Incorrect Permission Assignment for Critical Resource
ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted how python's os.chmod works when passed a mode of '-1'...
RHEL 7 : Virtualization Manager (RHSA-2019:3023)
An update for ovirt-engine-ui-extensions is now available for Red Hat Virtualization Engine 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
Moderate: Red Hat Security Advisory: ovirt-engine-ui-extensions security and bug fix update
An update for ovirt-engine-ui-extensions is now available for Red Hat Virtualization Engine 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
CVE-2018-1074
The ovirt-engine API and administration web portal exposed Power Management credentials including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control...
RHEL 7 : Virtualization Manager (RHSA-2019:2499)
An update for ovirt-engine-metrics is now available for Red Hat Virtualization Engine 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Information Disclosure
ovirt-engine-metrics is vulnerable to information disclosure. The passwords used in deployment and configuration of the oVirt Metrics are disclosed in log files...
Moderate: Red Hat Security Advisory: ovirt-engine-metrics security, bug fix, and enhancement update
An update for ovirt-engine-metrics is now available for Red Hat Virtualization Engine 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
ovirt-engine-metrics: disclosure of sensitive passwords in log files and ansible playbooks
Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclosed in log files if playbooks are run with -v or in playbooks stored on Metrics or Bastion hosts...
Moderate: Red Hat Bug Fix Advisory: ovirt-engine-api-explorer bug fix and enhancement update for RHV 4.3.4
Updated ovirt-engine-api-explorer packages that fix several bugs and add various enhancements are now available. The ovirt-engine-api-explorer package provides a web application for exploring the oVirt API documentation...
Moderate: Red Hat Bug Fix Advisory: ovirt-engine-api-explorer bug fix and enhancement update for RHV 4.3
Updated ovirt-engine-api-explorer packages that fix several bugs and add various enhancements are now available. The ovirt-engine-api-explorer package provides a web application for exploring the oVirt API documentation...
ovirt-engine: Missing permissions check in web ui allows a user with basic privileges to delete disks
It was discovered that in the ovirt REST API, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges e.g. Basic Operations could exploit this flaw to delete disks attached to...
