libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Aug 20, 2018 |
| Oracle_linux | — | Upgrade libvirt-daemon-kvmUpgrade libvirt-daemon-lxcUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-docsUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-clientUpgrade libvirt-daemon-driver-networkUpgrade libvirtUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-nssUpgrade libvirt-daemonUpgrade libvirt-login-shellUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-config-networkUpgrade libvirt-devel | Nov 9, 2016 | Aug 10, 2015 |
| Redhat_linux | — | Upgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-config-networkUpgrade libvirt-clientUpgrade libvirt-nssUpgrade libvirt-develUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-lxcUpgrade libvirtUpgrade libvirt-lock-sanlockUpgrade libvirt-docsNo solution existsUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-debuginfoUpgrade libvirt-login-shellUpgrade libvirt-daemon-driver-network | Nov 4, 2016 | Nov 3, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub