CVE-2019-10183

Name	CVE-2019-10183
Description	Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option accepts guest VM password as command line arguments, thus leaking them to others users on the system via process listing. It was introduced recently in the virt-manager v2.2.0 release.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
virt-manager (PTS)	bullseye	1:3.2.0-3	fixed
	bookworm	1:4.1.0-2	fixed
	trixie	1:5.0.0-3	fixed
	sid	1:5.0.0-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
virt-manager	source	(unstable)	(not affected)

- virt-manager <not-affected> (Vulnerable code introduced in v2.2.0)
https://www.redhat.com/archives/virt-tools-list/2019-July/msg00014.html