PT-2014-5396 · Postgresql+1 · Postgresql+2

CVE-2014-3561 · Publicado 2014-12-05 · Atualizado 2023-02-13

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Virtualization version 3.4

Description The issue allows local users to obtain sensitive information, specifically the PostgreSQL database password, by listing the processes. This is because the rhevm-log-collector package uses the password on the command line when calling sosreport.

Recommendations For Red Hat Enterprise Virtualization version 3.4, consider restricting access to the sosreport command and the rhevm-log-collector package to minimize the risk of exploitation. As a temporary workaround, avoid using the rhevm-log-collector package until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-3561

RHSA-2014:1947

Produtos afetados

Postgresql

Red Hat Enterprise Virtualization

Sosreport

Referências · 4

• http://securitytracker.com/id/1031291 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99096 · Nota
• http://rhn.redhat.com/errata/RHSA-2014-1947.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3561 · Nota de Segurança