PT-2018-7140 · Ovirt · Ovirt-Aaa-Jdbc-Tool

Dominic Geevarghese · Published 2018-07-27 · Updated 2019-10-09 · CVE-2017-2614

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: ovirt-aaa-jdbc-tool versions prior to 1.1.3

Description: The issue allows an attacker to change passwords on accounts with expired passwords, gaining access to those accounts, due to a failure in correctly checking the current password when updating it in the rhvm database.

Recommendations: For versions prior to 1.1.3, update to version 1.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to password change functionality for accounts with expired passwords until the update is applied.

Fix

RCE

Weakness Enumeration

CWE-640

CWE-20

Related Identifiers

CVE-2017-2614

RHSA-2017:0257

Affected Products

Ovirt-Aaa-Jdbc-Tool

References · 4

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2614 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2017-0257.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2614 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2614 · Security Note