medium6.5
CVE-2020-14301
An information disclosure vulnerability was found in libvirt in versions before 6.3.0.
Impact
An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker to access potentially sensitive information in the domain configuration via the `dumpxml` command.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Libvirt | from 6.2.0 before 6.3.0 |
| Redhat | Enterprise Linux | Version 8.0 |
| Redhat | Enterprise Linux Eus | Version 8.4 |
| Redhat | Enterprise Linux For Ibm Z Systems | Version 8.0 |
| Redhat | Enterprise Linux For Ibm Z Systems Eus | Version 8.4 |
| Redhat | Enterprise Linux For Power Little Endian | Version 8.0 |
| Redhat | Enterprise Linux For Power Little Endian Eus | Version 8.4 |
| Redhat | Enterprise Linux Server Aus | Version 8.4 |
| Redhat | Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions | Version 8.4 |
| Redhat | Enterprise Linux Server Update Services For Sap Solutions | Version 8.4 |
| Redhat | Enterprise Linux Tus | Version 8.4 |
| Netapp | Ontap Select Deploy Administration Utility | All versions |