{"id":"CVE-2019-10139","aliases":["EUVD-2019-2178","GHSA-35c5-8h9g-6345","RHSA-2019:2433","RHSA-2019:2437"],"status":"published","title":"During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var...","description":"During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted.","severity":{"version":"3.0","score":5.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.00245,"percentile":0.15822,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-311","CWE-522"],"published":"2019-05-17T15:28:59Z","modified":"2026-10-08T10:01:37Z","fixes":[{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"cockpit-ovirt","fixed_in":["0:0.13.5-1.el7ev"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"cockpit-ovirt-dashboard","fixed_in":["0:0.13.5-1.el7ev"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"cockpit-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.5-1.el7ev"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"cockpit-ovirt-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.5-1.el7ev"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.5-20190722.0.el7_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host-image-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.5-20190722.0.el7_7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"imgbased","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.9-0.1.el7ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"ovirt-node-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.5-0.20190717.0.el7ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"ovirt-node-ng-nodectl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.5-0.20190717.0.el7ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"python-imgbased","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.9-0.1.el7ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"python2-ovirt-node-ng-nodectl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.5-0.20190717.0.el7ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-release-virtualization-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.5-2.el7ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::hypervisor","package":"redhat-virtualization-host-image-update-placeholder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.5-2.el7ev"}]}],"bundled":6}],"products":[{"vendor":"ovirt","product":"cockpit-ovirt"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10139","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/108396","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2433","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2437","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10139","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10139","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1709829","tags":["report"]},{"url":"https://github.com/advisories/GHSA-35c5-8h9g-6345"},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1705911","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1709938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1719317","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1719327","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723322","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2433.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10139","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1640820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1658366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1683804","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1687920","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1694065","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1702223","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1718388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720160","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1724044","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1726534","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1727007","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1727859","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1728998","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1729023","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2437.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-16838","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16838","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16838","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-16881","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16881","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-0161","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0161","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0161","tags":["advisory"]},{"url":"https://edk2-docs.gitbooks.io/security-advisory/content/xhci-stack-local-stack-overflow.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1559","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1559","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1559","tags":["advisory"]},{"url":"https://github.com/RUB-NDS/TLS-Padding-Oracles","tags":["article"]},{"url":"https://www.openssl.org/news/secadv/20190226.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10160","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10160","tags":["advisory"]},{"url":"https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2019-10139","description":"During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted.","status":"published","published":"2019-05-17T15:28:59Z","modified":"2024-08-04T22:10:10.077Z","cvss":[{"version":"3.0","score":5.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:20:19.056416Z"}],"euvd":[{"id":"EUVD-2019-2178","description":"During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted.","status":"published","published":"2019-05-17T15:28:59Z","modified":"2024-08-04T22:10:10Z","cvss":[{"version":"3.0","score":5.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T02:40:53.61807Z"}],"ghsa":[{"id":"GHSA-35c5-8h9g-6345","title":"During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var...","description":"During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted.","status":"published","published":"2022-05-24T16:46:01Z","modified":"2023-02-13T00:31:00Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-311","CWE-522"],"updated_at":"2026-11-02T14:54:05.462623Z"}],"nvd":[{"id":"CVE-2019-10139","description":"During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted.","status":"published","published":"2019-05-17T16:29:03.017Z","modified":"2026-06-17T02:10:20.26Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":5.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-522","CWE-311"],"updated_at":"2026-11-02T14:05:13.880207Z"}],"osv":[{"id":"RHSA-2019:2433","title":"Red Hat Security Advisory: cockpit-ovirt security, bug fix, and enhancement update","status":"published","published":"2024-09-13T19:52:58Z","modified":"2026-06-29T10:25:56Z","cvss":[{"version":"3.0","score":5.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:2437","title":"Red Hat Security Advisory: Red Hat Virtualization security update","status":"published","published":"2024-09-13T19:53:41Z","modified":"2026-10-08T10:01:37Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:06.0195Z"}]}}