CVE-2019-10139

7.8 highEPSS 0.2%

During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
CWEs: CWE-522, CWE-311
Published: 2019-05-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ovirt:cockpit-ovirt

References

http://www.securityfocus.com/bid/108396
https://access.redhat.com/errata/RHSA-2019:2433
https://access.redhat.com/errata/RHSA-2019:2437
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10139
http://www.securityfocus.com/bid/108396

Check your stack JSON