CVE-2019-10139

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-05-17 · updated 2026-06-17
Weakness: CWE-522

Description

During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted.

Affected products

ovirt cockpit-ovirt: all versions

References

http://www.securityfocus.com/bid/108396
https://access.redhat.com/errata/RHSA-2019:2433
https://access.redhat.com/errata/RHSA-2019:2437
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10139
http://www.securityfocus.com/bid/108396
https://access.redhat.com/errata/RHSA-2019:2433
https://access.redhat.com/errata/RHSA-2019:2437
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10139

Get alerted when CVE-2019-10139 or the next vulnerability affects your stack