CVE-2017-15113

Опубликовано: 27 июл. 2018

Источник: nvd

CVSS3: 7.2

CVSS3: 6.6

CVSS2: 3.5

EPSS Низкий

Описание

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to troubleshoot issues.

Ссылки

http://www.securityfocus.com/bid/101933
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHEA-2017:3138
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15113
Issue Tracking
Patch
Third Party Advisory
https://gerrit.ovirt.org/gitweb?p=ovirt-engine.git%3Ba=commitdiff%3Bh=f4a5d0cc772127dbfe40789e26c4633ceea07d14%3Bhp=e6e8704ac9eb115624ff66e2965877d8e63a45f4
http://www.securityfocus.com/bid/101933
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHEA-2017:3138
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15113
Issue Tracking
Patch
Third Party Advisory
https://gerrit.ovirt.org/gitweb?p=ovirt-engine.git%3Ba=commitdiff%3Bh=f4a5d0cc772127dbfe40789e26c4633ceea07d14%3Bhp=e6e8704ac9eb115624ff66e2965877d8e63a45f4

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ovirt:ovirt:*:*:*:*:*:*:*:*

Версия до 4.1.7.6 (исключая)

Конфигурация 2

cpe:2.3:a:redhat:virtualization:4.1:*:*:*:*:*:*:*

EPSS

Процентиль: 56%

0.00344

Низкий

7.2 High

CVSS3

6.6 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-212

CWE-532

Связанные уязвимости

CVE-2017-15113

CVSS3: 7.2

redhat

около 8 лет назад

GHSA-m833-87vf-576c

CVSS3: 6.6

github

больше 3 лет назад

ovirt-engine Logs Plaintext Passwords To File

EPSS

Процентиль: 56%

0.00344

Низкий

7.2 High

CVSS3

6.6 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-212

CWE-532