Improper authentication in ovirt-engine - CVE-2024-0822

Vulnerability details

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in the CreateUserSession command when processing authentication requests. A remote attacker can bypass authentication process and gain unauthorized access to the application.

Affected software

How to mitigate CVE-2024-0822

External References

• https://bugzilla.redhat.com/show_bug.cgi?id=2258509
• https://github.com/oVirt/ovirt-engine/pull/914
• https://github.com/advisories/GHSA-4vwj-x32h-m4vj
• https://github.com/oVirt/ovirt-engine/releases/tag/ovirt-engine-4.5.6

Related Security Bulletins

• Authentication bypass in ovirt-engine
• Red Hat Virtualization Manager update for ovirt