Thom Carlin

O problema ocorre durante a instalação de um cluster do OpenShift 4, quando a ferramenta de linha de comando `openshift-install` cria um diretório `auth`. Esse diretório contém os arquivos `kubeconfig` e `kubeadmin-password`, que armazenam as credenciais para autenticação no servidor da API do OpenShift. No entanto, esses arquivos recebem permissões incorretas de leitura, o que pode expor as credenciais.

The issue allows local users with access to the system journal to obtain the root password by reading the system journal or by clicking Logs on the console, when the ssh service has been enabled on discovered nodes and discovery-debug is used to log in. This occurs because the root password is displayed in plaintext in the system journal.

The issue concerns a file, `/var/lib/ovirt-engine/setup/engine-DC-config.py`, created by Red Hat QuickStart Cloud Installer (QCI) that is world readable and contains the root password of the deployed system.

The issue concerns the Red Hat QuickStart Cloud Installer (QCI) using world-readable permissions for the /etc/qci/answers file. This allows local users to obtain the root password for the deployed system by reading the file.

The issue allows remote authenticated users with permission to view some hosts to obtain sensitive host configuration information. This is possible because access to preview provisioning templates is not properly restricted.