Thom Carlin

The issue arises during the installation of an OpenShift 4 cluster, where the `openshift-install` command line tool creates an `auth` directory. This directory contains `kubeconfig` and `kubeadmin-password` files, which hold credentials for authenticating to the OpenShift API server. However, these files are incorrectly assigned word-readable permissions, potentially exposing the credentials.

The issue allows local users with access to the system journal to obtain the root password by reading the system journal or by clicking Logs on the console, when the ssh service has been enabled on discovered nodes and discovery-debug is used to log in. This occurs because the root password is displayed in plaintext in the system journal.

The issue concerns a file, `/var/lib/ovirt-engine/setup/engine-DC-config.py`, created by Red Hat QuickStart Cloud Installer (QCI) that is world readable and contains the root password of the deployed system.

The issue concerns the Red Hat QuickStart Cloud Installer (QCI) using world-readable permissions for the /etc/qci/answers file. This allows local users to obtain the root password for the deployed system by reading the file.

The issue allows remote authenticated users with permission to view some hosts to obtain sensitive host configuration information. This is possible because access to preview provisioning templates is not properly restricted.