PT-2018-7140 · Ovirt · Ovirt-Aaa-Jdbc-Tool

Dominic Geevarghese · Publicado 2018-07-27 · Atualizado 2019-10-09 · CVE-2017-2614

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: ovirt-aaa-jdbc-tool versions prior to 1.1.3

Description: The issue allows an attacker to change passwords on accounts with expired passwords, gaining access to those accounts, due to a failure in correctly checking the current password when updating it in the rhvm database.

Recommendations: For versions prior to 1.1.3, update to version 1.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to password change functionality for accounts with expired passwords until the update is applied.

Correção

RCE

Enumeração de Fraquezas

CWE-640

CWE-20

Identificadores relacionados

CVE-2017-2614

RHSA-2017:0257

Produtos afetados

Ovirt-Aaa-Jdbc-Tool

Referências · 4

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2614 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2017-0257.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-2614 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2614 · Nota de Segurança