Bug 1371428 (CVE-2016-5432)

Summary:	CVE-2016-5432 ovirt-engine: ovirt-engine-provisiondb logs contain DB username and password in plain text
Product:	[Other] Security Response	Reporter:	Martin Prpič <mprpic>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bmcclain, dblechte, didi, eedri, gklein, lsurette, mgoldboi, michal.skrivanek, nobody, rbalakri, Rhev-m-bugs, sherold, srevivo, ykaul, ylavi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	It was found that the ovirt-engine-provisiondb utility did not correctly sanitize the authentication details used with the “—provision*db” options from the output before storing them in log files. This could allow an attacker with read access to these log files to obtain sensitive information such as passwords.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-09-29 19:12:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1371612, 1371613
Bug Blocks:	1371429

Description Martin Prpič 2016-08-30 08:15:02 UTC

When ovirt-engine-provisiondb, a utility usually called by engine-backup, was passed one of the '--provision*db' options to create postgresql DBs/users, the password of the created user is stored in the log file in plain text.

Comment 1 Martin Prpič 2016-08-30 08:15:18 UTC

Acknowledgments:

Name: Yedidyah Bar David (Red Hat)

Comment 2 Martin Prpič 2016-08-30 08:16:08 UTC

Fix included in:

https://gerrit.ovirt.org/#/q/I40c88ad48f8f7c2b8e06802137870b0c198b5129

Comment 4 errata-xmlrpc 2016-09-28 22:16:33 UTC

This issue has been addressed in the following products:

  RHEV Engine version 4.0

Via RHSA-2016:1967 https://rhn.redhat.com/errata/RHSA-2016-1967.html