Bug 1718080 (CVE-2019-10159)
| Summary: | CVE-2019-10159 cfme: Improper authorization in migration log controller allows any user to access VM migration logs | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Richard Maciel Costa <rcosta> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | dajohnso, dmetzger, gblomqui, gmccullo, gtanzill, jfrey, jhardy, jprause, kdixon, mzazrivec, obarenbo, roliveri, simaishi |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A data leak vulnerability was found in cfme-gemset, in versions including and prior to 5.10.4.3 and versions including and prior to 5.9.9.3, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user account can access all VM migration logs available.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-13 08:47:05 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1718081, 1718082 | ||
| Bug Blocks: | 1685593 | ||
|
Description
Richard Maciel Costa
2019-06-06 20:37:15 UTC
Acknowledgments: Name: Milan Zazrivec (Red Hat) This issue has been addressed in the following products: CloudForms Management Engine 5.10 Via RHSA-2019:2466 https://access.redhat.com/errata/RHSA-2019:2466 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-10159 |