CVE-2019-10472

The CVE-2019-10472 involves Jenkins Libvirt Slaves Plugin where a missing permission check allows attackers with Overall/Read to initiate SSH connections to an attacker-controlled server using attacker-controlled credentials IDs, potentially capturing credentials stored in Jenkins. The connected ...

CVE-2019-10473

A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins...

CVE-2019-10472

A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2019-10473

A vulnerability in the Jenkins Libvirt Slaves Plugin (credential enumeration) arises from a missing permission check in form-related methods. Affected component(s): Libvirt Slaves Plugin, form-related credential handling. Root cause: insufficient access control allows users with Overall/Read to e...

CVE-2019-10471

CVE-2019-10471 is a cross-site request forgery vulnerability in the Jenkins Libvirt Slaves Plugin. The issue allows an attacker to trigger actions that cause the server to connect to an attacker-specified SSH server using credentials IDs chosen by the attacker, potentially exposing credentials st...

CVE-2019-10471

A cross-site request forgery vulnerability in Jenkins Libvirt Slaves Plugin allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

PT-2019-11865 · Jenkins · Jenkins Libvirt Slaves Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Libvirt Slaves Plugin affected versions not specified Description: A cross-site request forgery issue allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs, potentially capturing...

PT-2019-11866 · Jenkins · Jenkins Libvirt Slaves Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Libvirt Slaves Plugin affected versions not specified Description: A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified...

PT-2019-11867 · Jenkins · Jenkins Libvirt Slaves Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Libvirt Slaves Plugin affected versions not specified Description: A missing permission check in form-related methods of the Jenkins Libvirt Slaves Plugin allowed users with Overall/Read access to enumerate credentials ID of credentia...

Photon OS 3.0: Libvirt PHSA-2019-3.0-0032

An update of the libvirt package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-3.0-0032. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid130112;...

SUSE-RU-2019:2715-1 Recommended update for xen

This update for xen to version 4.12.1 fixes the following issues: - Fixed an issue which made Xen crash on AMD ROME based machines bsc1135799. - Xenpvnetboot is now ported correctly to Python 3 bsc1138563. - Added code to change LIBXLHOTPLUGTIMEOUT at runtime bsc1120095. The included README has...

Security Bulletin: A vulnerability in Open Source Libvirt affects IBM Netezza Host Management

Summary Open Source Libvirt is used by IBM Netezza Host Management. IBM Netezza Host Management has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-10161 DESCRIPTION: libvirt could allow a local authenticated attacker to gain elevated privileges on the system, caused by improp...

CVE-2019-10132

A flaw was found in libvirt in version 4.1.0 and earlier. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons. The highest threat from this...

Critical Photon OS Security Update - PHSA-2019-0032

Updates of 'libvirt', 'curl', 'openssl' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2019-3.0-0032

Updates of 'openssl', 'curl', 'libvirt' packages of Photon OS have been released...

EulerOS 2.0 SP3 : libvirt (EulerOS-SA-2019-2020)

According to the versions of the libvirt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API CVE-2019-10161 - libvirt: arbitrary command execution via...

EulerOS Virtualization for ARM 64 3.0.2.0 : libvirt (EulerOS-SA-2019-1957)

According to the versions of the libvirt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - It was discovered that libvirtd would permit read-only clients to use the virDomainSaveImageGetXMLDesc API, specifyin...

SUSE SLES12 Security Update : libvirt (SUSE-SU-2019:2227-2)

This update for libvirt fixes the following issues : Security issues fixed : CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd...

NewStart CGSL MAIN 4.06 : libvirt Vulnerability (NS-SA-2019-0173)

The remote NewStart CGSL host, running version MAIN 4.06, has libvirt packages installed that are affected by a vulnerability: - It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc API, specifying an arbitrary pat...

libvirt security update

CentOS Errata and Security Advisory CESA-2019:2294 An update for libvirt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...