CVE-2016-6341 - ovirt-engine: DWH_DB_PASSWORD is in cleartext in the log files

Back Back to CVE browser

MEDIUM

ovirt-engine: DWH_DB_PASSWORD is in cleartext in the log files

Published Apr 20, 2017

5.9

MEDIUM

CVSS 3.0

EPSS 0.35%

Description

oVirt Engine before 4.0.3 does not include DWH_DB_PASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files.

Affected products

Red Hat Enterprise Virtualization 3

ovirt-engine

Affected
Red Hat Virtualization 4

ovirt-engine

Affected

Product	Package	State	Advisory
Red Hat Enterprise Virtualization 3	ovirt-engine	Affected	n/a
Red Hat Virtualization 4	ovirt-engine	Affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-312

References (7)

http://www.securityfocus.com/bid/92665
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2016-6341
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1363816
x_refsource_CONFIRMIssue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1369793
x_refsource_CONFIRMIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2016-6341
https://www.cve.org/CVERecord?id=CVE-2016-6341
https://www.ovirt.org/release/4.0.3/
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/92665		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2016-6341		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1363816		x_refsource_CONFIRMIssue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1369793		x_refsource_CONFIRMIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2016-6341
https://www.cve.org/CVERecord?id=CVE-2016-6341
https://www.ovirt.org/release/4.0.3/		x_refsource_CONFIRMPatchVendor Advisory