PT-2014-5396 · Postgresql+1 · Postgresql+2

Published 2014-12-05 · Updated 2023-02-13 · CVE-2014-3561

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Virtualization version 3.4

Description The issue allows local users to obtain sensitive information, specifically the PostgreSQL database password, by listing the processes. This is because the rhevm-log-collector package uses the password on the command line when calling sosreport.

Recommendations For Red Hat Enterprise Virtualization version 3.4, consider restricting access to the sosreport command and the rhevm-log-collector package to minimize the risk of exploitation. As a temporary workaround, avoid using the rhevm-log-collector package until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-3561

RHSA-2014:1947

Affected Products

Postgresql

Red Hat Enterprise Virtualization

Sosreport

References · 4

• http://rhn.redhat.com/errata/RHSA-2014-1947.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3561 · Security Note
• http://securitytracker.com/id/1031291 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99096 · Note