CVE-2014-3561
published 2014-12-05CVE-2014-3561: The rhevm-log-collector package in Red Hat Enterprise Virtualization 3.4 uses the PostgreSQL database password on the command line when calling sosreport…
PriorityP46low2.1CVSS 2.0
AVLACLAuNCPINAN
EPSS
0.38%
29.6th percentile
The rhevm-log-collector package in Red Hat Enterprise Virtualization 3.4 uses the PostgreSQL database password on the command line when calling sosreport, which allows local users to obtain sensitive information by listing the processes.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_virtualization | — | — |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ovirt-engine-log-collector: database password disclosed in process listing
vendor_redhat·2014-12-02·CVSS 2.1
CVE-2014-3561 [LOW] CWE-522 ovirt-engine-log-collector: database password disclosed in process listing
ovirt-engine-log-collector: database password disclosed in process listing
The rhevm-log-collector package in Red Hat Enterprise Virtualization 3.4 uses the PostgreSQL database password on the command line when calling sosreport, which allows local users to obtain sensitive information by listing the processes.
It was found that rhevm-log-collector called sosreport with the PostgreSQL database password passed as a command line parameter. A local attacker could read this password by monitoring a process listing. The password would also be written to a log file, which could potentially be read by a local attacker.
GHSA
GHSA-xxxj-4ccj-cfw9: The rhevm-log-collector package in Red Hat Enterprise Virtualization 3
ghsa_unreviewed·2022-05-17
CVE-2014-3561 [LOW] CWE-200 GHSA-xxxj-4ccj-cfw9: The rhevm-log-collector package in Red Hat Enterprise Virtualization 3
The rhevm-log-collector package in Red Hat Enterprise Virtualization 3.4 uses the PostgreSQL database password on the command line when calling sosreport, which allows local users to obtain sensitive information by listing the processes.
No detection rules found.
No public exploits indexed.
2014-12-05
Published