CVE-2016-6338

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager aka RHEV-M for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries...

CVE-2016-6341

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...

CVE-2016-6341

The CVE affects oVirt Engine prior to 4.0.3. The root cause is that DWH_DB_PASSWORD is not hidden in engine log files, enabling local users to read logs and obtain sensitive password information. Impact is information disclosure affecting confidentiality. The documented remediation is to upgrade ...

PT-2017-8969

Name of the Vulnerable Software and Affected Versions oVirt Engine versions prior to 4.0.3 Description The issue allows local users to obtain sensitive password information by reading engine log files, as the DWH DB PASSWORD is not included in the list of keys to hide in log files. Recommendation...

CVE-2016-6338: Improper Access Control

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager aka RHEV-M for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries...

CVE-2016-6341: Exposure of Sensitive Information to an Unauthorized Actor

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...

RHEL 7 : ovirt-engine-extension-aaa-jdbc (RHSA-2017:0257)

An update for ovirt-engine-extension-aaa-jdbc is now available for RHEV Engine version 4.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2016-5432

The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization RHEV Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files...

CVE-2016-5432

The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization RHEV Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files...

CVE-2016-5432

CVE-2016-5432 affects the ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0. The root cause is that authentication details used with --provision*db outputs were not properly sanitized before being written to log files, potentially exposing sensitive informati...

PT-2016-6427 · Red Hat · Red Hat Enterprise Virtualization

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization RHEV Engine version 4.0 Description: The issue allows local users to obtain sensitive database provisioning information. This is achieved by reading log files, specifically those generated by the...

CVE-2016-5432: Insertion of Sensitive Information into Log File

The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization RHEV Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files...

ovirt-engine: ovirt-engine-provisiondb logs contain DB username and password in plain text

It was found that the ovirt-engine-provisiondb utility did not correctly sanitize the authentication details used with the “—provisiondb” options from the output before storing them in log files. This could allow an attacker with read access to these log files to obtain sensitive information such...

Red Hat oVirt Engine Local Information Disclosure Vulnerability

Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . A local information disclosure vulnerability exists in...

Red Hat oVirt Engine Information Disclosure Vulnerability (CNVD-2016-07080)

Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . An information disclosure vulnerability exists in Red H...

CVE-2016-5432

It was found that the ovirt-engine-provisiondb utility did not correctly sanitize the authentication details used with the “—provisiondb” options from the output before storing them in log files. This could allow an attacker with read access to these log files to obtain sensitive information such...

Red Hat oVirt Engine Local Security Bypass Vulnerability

Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . A local security bypass vulnerability exists in Red Hat...

Red Hat oVirt Engine Information Disclosure Vulnerability (CNVD-2016-06917)

Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . An information disclosure vulnerability exists in Red H...

CVE-2016-6341

oVirt Engine before 4.0.3 does not include DWHDBPASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files...

Red Hat oVirt Engine Information Disclosure Vulnerability (CNVD-2016-06304)

Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . An information disclosure vulnerability exists in Red H...