Permissions, Privileges, and Access Controls in libvirt - CVE-2019-3886
Published: June 19, 2019
Vulnerability identifier: #VU18847
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-3886
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information or perform denial of service (DoS) attack.
The vulnerability exists due to the application allows readonly permissions to invoke the APIs depending on the guest agent. A remote non-authenticated attacker can gain access to sensitive information or perform denial of service attack.
Affected software
libvirt
libvirt (Ubuntu package)
libvirt
Red Hat Virtualization
Fedora
Opensuse
libvirt (Ubuntu package)
libvirt
Red Hat Virtualization
Fedora
Opensuse
How to mitigate CVE-2019-3886
Install updates from vendor's website.
libvirt (Ubuntu package) - addressed in versions 4.6.0-2ubuntu3.7, 5.0.0-1ubuntu2.3
libvirt - addressed in versions 4.7.0-5.fc29, 5.1.0-9.fc30
libvirt - addressed in versions 4.7.0-5.fc29, 5.1.0-9.fc30