Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2018-1062 Details

Description

A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially sensitive data could be revealed to privileged users of that VM.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://access.redhat.com/errata/RHBA-2018:0135 CVEThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1549944 CVEIssue TrackingThird Party Advisory
https://gerrit.ovirt.org/#/c/84861/ CVEVendor Advisory
https://gerrit.ovirt.org/#/c/84875/ CVEVendor Advisory
http://www.securityfocus.com/bid/103433 CVEThird Party AdvisoryVDB Entry

see all 10 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-212Improper Removal of Sensitive Information Before Storage or Transfer[email protected]
CWE-212Improper Removal of Sensitive Information Before Storage or Transfer[email protected]

Affected Products

ProductVersions
redhat ovirt-engine
>= 4.1.0, < 4.1.9

CPE

  • cpe:2.3:a:redhat:ovirt-engine:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

9 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2018-1062
NVD Published Date:
Mar 6, 2018
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]