CVE-2018-1072: Ovirt

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provision*db", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database passwords.

Affected products

• Ovirt Ovirt: before 4.2.2 (fixed in 4.2.2)
• Red Hat Enterprise Virtualization Manager: version 4.2 only

Published 2018-06-26. Last modified 2026-06-17.