CVE-2022-2806

This CVE (CVE-2022-2806) concerns the sos/os-report tooling used by ovirt-log-collector where the RHV admin password could be collected unfiltered. The vulnerability is tied to the sos package and related components; fixes were released in sos-4.2-20.el8_6 and ovirt-log-collector-4.4.7-2.el8ev. A...

PT-2022-18786

Name of the Vulnerable Software and Affected Versions ovirt-log-collector versions prior to 4.4.7-2.el8ev sosreport versions prior to 4.2-20.el8 6 Description The issue concerns the handling of sensitive information by the sosreport and ovirt-log-collector. Specifically, it was found that the...

CVE-2022-2806: Exposure of Sensitive Information to an Unauthorized Actor

It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el86, ovirt-log-collector-4.4.7-2.el8ev...

SoS 安全漏洞

SoS is sosreport open source an extensible , portable , support data collection tool . Used to collect system logs and other debugging information. SoS suffers from a security vulnerability that stems from ovirt-log-collector/sosreport collecting unfiltered RHV administrator passwords...

CVE-2022-2806

A flaw was found in the ovirt-log-collector, which led to the logging of plaintext passwords in the log file. This flaw allows an attacker with sufficient privileges to read the log file, leading to a loss of confidentiality...

CVE-2022-2805

A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with sufficient privileges to read the log file, leading to confidentiality loss...

RHEL 8 : RHV Manager (ovirt-engine) [ovirt-4.5.1] (RHSA-2022:5555)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5555 advisory. The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform that allows system administrators to...

The vulnerability of the Ovirt virtual infrastructure management tool, related to information disclosure, allows a hacker to gain access to the open SSH key of other users.

The vulnerability of the Ovirt virtual infrastructure management tool is related to the disclosure of information. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the open SSH key of other users...

RHEL 8 : RHV Appliance (rhvm-appliance) security update [ovirt-4.5.0] (Moderate) (RHSA-2022:4931)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:4931 advisory. The RHV-M Appliance automates the process of installing and configuring the Red Hat Virtualization Manager. The appliance is available to download as...

RHEL 8 : Red Hat Virtualization security, update [ovirt-4.5.0] (Important) (RHSA-2022:4896)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4896 advisory. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host,...

RHEL 8 : RHV Manager (ovirt-engine) [ovirt-4.5.0] (RHSA-2022:4711)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4711 advisory. The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform that allows system administrators to...

RHEL 8 : RHV Host (ovirt-host) (RHSA-2022:4764)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:4764 advisory. The ovirt-host package consolidates host package requirements into a single meta package. Security Fixes from Bugzilla: vdsm: disclosure of sensitive...

Low: Red Hat Security Advisory: RHV RHEL Host (ovirt-host) [ovirt-4.5.0] security update

Updated host packages that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.0] security update

Updated ovirt-engine packages that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

ovirt-engine-sdk-python improper validation of hostname in x.509 certificate

ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name CN or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an...

ovirt-engine Logs Plaintext Passwords To File

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to...

GHSA-M833-87VF-576C ovirt-engine Logs Plaintext Passwords To File

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to...

oVirt REST API 路径遍历漏洞

The oVirt REST API is an application programming interface. A path traversal vulnerability exists in the oVirt REST API that stems from improper access restrictions in seven REST API endpoints. An unauthenticated remote attacker could bypass the implemented security restrictions and gain...

CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...