CVSS: 4.7EPSS: 0%CPEs: 5EXPL: 0CVE-2022-0207 – vdsm: disclosure of sensitive values in log files
https://notcve.org/view.php?id=CVE-2022-0207
27 May 2022 — A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values being stored in clear text. Se encontró una condición de carrera en vdsm. Funcionalidad para ofuscar valores sensibles en archivos de registro que puede conllevar a que los valores sean almacenados en texto sin cifrar. The ovirt-host package consolidates host package requirements into a single meta package. • https://access.redhat.com/security/cve/CVE-2022-0207 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2012-5518
https://notcve.org/view.php?id=CVE-2012-5518
25 Nov 2019 — vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matching key (and certificate) vdsm: la generación de certificados tras creación del nodo, permitiendo que vdsm inicie y sirva peticiones de cualquier persona que tenga una clave coincidente (y un certificado). • http://www.openwall.com/lists/oss-security/2012/11/11/3 • CWE-295: Improper Certificate Validation •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3831 – vdsm: privilege escalation to root via systemd_run
https://notcve.org/view.php?id=CVE-2019-3831
05 Mar 2019 — A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function exposed to the vdsm system user could be abused to execute arbitrary commands as root. Se ha detectado una vulnerabilidad en vdsm, desde la versión 4.19 hasta la 4.30.3 y desde la 4.30.5 hasta la 4.30.8.. La función systemd_run expuesta al usuario del sistema vdsm podría ser abusada para ejecutar comandos arbitrarios como root. The redhat-virtualization-host packages provide the Red Hat Vi... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3831 • CWE-863: Incorrect Authorization •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-10908
https://notcve.org/view.php?id=CVE-2018-10908
09 Aug 2018 — It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host. Se ha detectado que vdsm en versiones anteriores a la 4.20.37 invoca qemu-img en entradas no fiables sin limitar recursos. Mediante la subida de una imagen especialmente m... • http://lists.nongnu.org/archive/html/qemu-block/2018-07/msg00488.html • CWE-20: Improper Input Validation CWE-770: Allocation of Resources Without Limits or Throttling •