CVE-2014-3706
published 2017-10-18CVE-2014-3706: ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509…
PriorityP424medium5.9CVSS 3.0
AVNACHPRNUINSUCHINAN
EPSS
0.72%
50.2th percentile
ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_mrg | — | — |
CVSS provenance
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ovirt-engine: connection does not validate certificate attributes.
vendor_redhat·2015-02-20·CVSS 5.9
CVE-2014-3706 [MEDIUM] CWE-295 ovirt-engine: connection does not validate certificate attributes.
ovirt-engine: connection does not validate certificate attributes.
ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates.
Statement: This issue affects the versions of ovirt-engine as shipped with Red Hat MRG 3. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Package: ovirt-engine-backend (Red Hat Enterprise Virtualization 3) - Will not fix
GHSA
GHSA-g7pg-wj9c-h3j9: ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X
ghsa_unreviewed·2022-05-17
CVE-2014-3706 [MEDIUM] CWE-295 GHSA-g7pg-wj9c-h3j9: ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X
ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates.
No detection rules found.
No public exploits indexed.
2017-10-18
Published