CVE-2016-5432
low
CVSS v3
3.3
CVSS v2
2.1
VIR risk
3.3
Description
The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files.
Predictions
Exploit likelihood
34%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: secalert@redhat.com — https://gerrit.ovirt.org/#/q/I40c88ad48f8f7c2b8e06802137870b0c198b5129
Vendor advisory: secalert@redhat.com — https://bugzilla.redhat.com/show_bug.cgi?id=1371428
Vendor advisory: secalert@redhat.com — http://rhn.redhat.com/errata/RHSA-2016-1967.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rhel | 7.0 | not-affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| redhat | enterprise_virtualization | 4.0 | |
References
- http://rhn.redhat.com/errata/RHSA-2016-1967.html
- http://www.securityfocus.com/bid/92694
- https://bugzilla.redhat.com/show_bug.cgi?id=1371428
- https://gerrit.ovirt.org/#/q/I40c88ad48f8f7c2b8e06802137870b0c198b5129
- http://rhn.redhat.com/errata/RHSA-2016-1967.html
- http://www.securityfocus.com/bid/92694
- https://bugzilla.redhat.com/show_bug.cgi?id=1371428
- https://gerrit.ovirt.org/#/q/I40c88ad48f8f7c2b8e06802137870b0c198b5129
CWEs
CWE-532
Verify integrity in audit chain (admin only). AS-IS.