PatchTheCVECVE-2018-1075: ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning
CVE-2018-1075 is a medium-severity flaw (CVSS 5.0) affecting ovirt. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2018-1075?
ovirt: upgrade to 4.2.3. Exact commands for each OS are on this page.
Is CVE-2018-1075 being exploited?
CVE-2018-1075 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2018-1075 affect?
CVE-2018-1075 affects ovirt. Severity is medium (CVSS 5.0). ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input
How urgent is CVE-2018-1075?
Priority 25/100. No elevated risk signals yet.
Related CVEs
- CVE-2019-3879 HIGH 8.1 UPGRADE MITIGATE It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an in
- CVE-2019-10194 MEDIUM 5.5 MITIGATE DOWNGRADE Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions
- CVE-2018-1074 HIGH 7.7 UPGRADE DOWNGRADE ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure
- CVE-2018-1072 MEDIUM 5.0 UPGRADE DOWNGRADE ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files
- CVE-2017-15113 HIGH 7.2 UPGRADE DOWNGRADE ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without mas