Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option accepts guest VM password as command line arguments, thus leaking them to others users on the system via process listing. It was introduced recently in the virt-manager v2.2.0 release.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3464 advisory.

    [2.2.1-2.0.1]
    - Add OL release support to virt-install for OL KVM guest creation [Orabug: 26135782]

    [2.2.1-2]
    - man: virt-install: Fix a couple of launchSecurity related typos (rhbz#1741846)

    [2.2.1-1]
    - Rebased to virt-manager-2.2.1 (rhbz#1726535)
    - The rebase also fixes the following bugs:
        rhbz#1727881, rhbz#1724287, rhbz#1727811
    - spec: add gtksourceview3 dependency introduced by upstream (rhbz#1722820)
    - guest: fix warning message when machine type is changed for secure boot (rhbz#1727811)

    [2.2.0-2]
    - xmleditor: Handle gtksourceview3 as well as gtksourceview4 (rhbz#1722820)
    - xmleditor: Fix the gtksource version checking (rhbz#1722820)
    - spec: add gtksourceview3 dependency introduced by upstream (rhbz#1722820)

    [2.2.0-1]
    - Rebased to virt-manager-2.2.0 (rhbz#1721001)
    - The rebase also fixes the following bugs:
        rhbz#1718065, rhbz#1714304, rhbz#1709857, rhbz#1707379, rhbz#1700354         rhbz#1692489, rhbz#1690687, rhbz#1690685, rhbz#1683609, rhbz#1679018         rhbz#1677019, rhbz#1671599, rhbz#1667025, rhbz#1666597, rhbz#1663430         rhbz#1661867, rhbz#1660467, rhbz#1660123, rhbz#1659354, rhbz#1658511         rhbz#1648939, rhbz#1599139, rhbz#1508147, rhbz#1501608
    - spec: add build dependencies that are now required for build (rhbz#1721001)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3464 advisory.

  - virt-install: unattended option leaks password via command line argument (CVE-2019-10183)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3464 advisory.

    Virtual Machine Manager (virt-manager) is a graphical tool for administering virtual machines for KVM,     Xen, and Linux Containers (LXC). The virt-manager utility uses the libvirt API and can start, stop, add or     remove virtualized devices, connect to a graphical or serial console, and view resource usage statistics     for existing virtualized guests on local or remote machines.

    The following packages have been upgraded to a later upstream version: virt-manager (2.2.1). (BZ#1727881)

    Security Fix(es):

    * virt-install: unattended option leaks password via command line argument (CVE-2019-10183)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
180824	Oracle Linux 8 : virt-manager (ELSA-2019-3464)	Nessus	Oracle Linux Local Security Checks	low
145687	CentOS 8 : virt-manager (CESA-2019:3464)	Nessus	CentOS Local Security Checks	low
130541	RHEL 8 : virt-manager (RHSA-2019:3464)	Nessus	Red Hat Local Security Checks	low

Detections

Analytics

CVE-2019-10183

low

Tenable Plugins

low

low

low