CVE-2018-1117

    Dashboard / Vulnerabilities / CVE-2018-1117

    CVE-2018-1117

    Published: 20 Jun 2018Last Modified: 8 Jul 2026

    Summary:

    Details: ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.

    References: http://www.securityfocus.com/bid/104186, https://access.redhat.com/errata/RHSA-2018:1452, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1117

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -ddbd9c6447e9888195969b36cdd996557be5bb5e

    Affected versions

    1.0.5
    1.0.3
    1.0.2
    1.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High