CVE-2018-1117

Red Hat statement

This is a Low impact vulnerability in Red Hat Enterprise Virtualization. The 'Add oVirt Provider to ManageIQ/CloudForms' Ansible playbook, part of `ovirt-ansible-roles`, inadvertently logs administrative passwords due to a missing `no_log` directive. Exploitation requires an attacker to have access to these provisioning logs, which are typically restricted to administrators, limiting the attack surface.

Red Hat mitigation

To mitigate the risk of administrative password disclosure, ensure that system logs, particularly those generated during oVirt provider provisioning, are protected with strict access controls. Limit access to these logs to authorized personnel only and avoid sharing them with untrusted systems or users.