Bug 1709829 (CVE-2019-10139)

Summary: CVE-2019-10139 cockpit-ovirt: admin and appliance passwords saved in plain text variable file during HE deployment
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bmcclain, dblechte, dfediuck, dmoppert, eedri, emarcus, irosenzw, mgoldboi, michal.skrivanek, sbonazzo, security-response-team, sherold, slong, stirabos, yturgema
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A credential-protection flaw was found in cockpit-ovirt. During deployment, it generated an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contained both admin and appliance passwords as plain-text. Although these files are deleted at the end of the deployment procedure, a local attacker could exploit this flaw to access the passwords.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2019-08-12 14:47:06 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1711192, 1711193    
Bug Blocks: 1709830    

Description Marian Rehak 2019-05-14 11:42:25 UTC 
During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted.
Comment 1 Doran Moppert 2019-05-17 07:48:26 UTC 
See bug 1703678
Comment 10 errata-xmlrpc 2019-08-12 11:53:45 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2019:2433 https://access.redhat.com/errata/RHSA-2019:2433
Comment 11 errata-xmlrpc 2019-08-12 11:54:22 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2019:2437 https://access.redhat.com/errata/RHSA-2019:2437
Comment 12 Product Security DevOps Team 2019-08-12 14:47:06 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-10139