Vulnerability record · CVE-2018-1117 · published 20 June 2018

CVE-2018-1117: Ovirt-ansible-roles sensitive information in log file vulnerability

Ovirt · Ovirt Ansible Roles

ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.

9.8 CVSS 3.0 Critical EPSS 1.4% · top 28.5% CWE-532 · Sensitive information in log file

9.8CVSS 3.0 base score, v2 5.0

1.4%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Ovirt Ansible Roles Ovirt

Enterprise Virtualization Redhat

References

Link	Tags
http://www.securityfocus.com/bid/104186	Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:1452	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1117	Issue TrackingThird Party Advisory
http://www.securityfocus.com/bid/104186	Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:1452	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1117	Issue TrackingThird Party Advisory

Track CVE-2018-1117 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-3522Redhat enterprise virtualization memory buffer overflow vulnerabilityBuffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an…EPSS 4.5%2 Oct 2008 9.8CVE-2013-1591Redhat enterprise virtualization integer overflow vulnerabilityStack-based buffer overflow in libpixman, as used in Pale Moon before 15.4 and possibly other products, has unspecified impact and context-dependent …EPSS 3.6%31 Jan 2013 7.7CVE-2015-3456Qemu memory buffer overflow vulnerabilityThe Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bou…EPSS 15%13 May 2015 7.5CVE-2015-5201Redhat enterprise virtualization missing authentication for critical function vulnerabilityVDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as pack…EPSS 1.5%25 Feb 2020 7.5CVE-2018-1111Red Hat DHCP client NetworkManager script command injectionThe DHCP client packages in Red Hat Enterprise Linux 6 and 7, Fedora 28 and earlier ship a NetworkManager integration script that is vulnerable to co…EPSS 98%analysed17 May 2018 7.2CVE-2018-1074Ovirt information exposure vulnerabilityovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, includ…EPSS 1.5%26 Apr 2018 7.2CVE-2013-2151Redhat enterprise virtualization vulnerabilityUnquoted Windows search path vulnerability in Red Hat Enterprise Virtualization (RHEV) 3 and 3.2 allows local users to gain privileges via a crafted …EPSS 0.41%21 Jan 2014 7.2CVE-2013-2152Redhat enterprise virtualization vulnerabilityUnquoted Windows search path vulnerability in the SPICE service, as used in Red Hat Enterprise Virtualization (RHEV) 3.2, allows local users to gain …EPSS 0.41%21 Jan 2014

Source: NIST National Vulnerability Database (record CVE-2018-1117), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.