{"id":"CVE-2018-1117","aliases":["EUVD-2018-11761","GHSA-xghx-gh8p-84h2","RHSA-2018:1452"],"status":"published","title":"ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive,...","description":"ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.","severity":{"version":"3.0","score":5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01356,"percentile":0.71822,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2018-06-19T13:00:00Z","modified":"2026-10-24T10:30:35Z","fixes":[{"ecosystem":"Red Hat:rhev_manager:4","package":"ovirt-ansible-roles","fixed_in":["0:1.0.6-1.el7ev"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:rhev_manager:4","package":"ovirt-ansible-roles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-1.el7ev"}]}]}],"products":[{"vendor":"[unknown]","product":"ovirt-ansible-roles"},{"vendor":"ovirt","product":"ovirt-ansible-roles"},{"vendor":"redhat","product":"enterprise_virtualization"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1117","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://www.securityfocus.com/bid/104186","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1452","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1117","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xghx-gh8p-84h2"},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1574776","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1452.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1117","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1117","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-1117","description":"ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.","status":"published","published":"2018-06-19T13:00:00Z","modified":"2024-08-05T03:51:48.428Z","cvss":[{"version":"3.0","score":5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:35:08.341767Z"}],"euvd":[{"id":"EUVD-2018-11761","description":"ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.","status":"published","published":"2018-06-19T13:00:00Z","modified":"2024-08-05T03:51:48Z","cvss":[{"version":"3.0","score":5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T02:40:16.874515Z"}],"ghsa":[{"id":"GHSA-xghx-gh8p-84h2","title":"ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive,...","description":"ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.","status":"published","published":"2022-05-13T01:33:31Z","modified":"2023-02-01T05:08:35Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:50:48.372333Z"}],"nvd":[{"id":"CVE-2018-1117","description":"ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.","status":"published","published":"2018-06-20T01:29:02.243Z","modified":"2026-06-17T01:50:30.98Z","cvss":[{"version":"3.0","score":5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:04:29.837913Z"}],"osv":[{"id":"CVE-2018-1117","description":"ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.","status":"published","published":"2018-06-20T01:29:02.243Z","modified":"2026-10-24T10:30:35.438690187Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"RHSA-2018:1452","title":"Red Hat Security Advisory: ovirt-ansible-roles security update","status":"published","published":"2024-09-13T16:51:22Z","modified":"2026-08-08T10:01:36Z","cvss":[{"version":"3.0","score":5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.822845Z"}]}}