CVE-2017-2614

6.8MEDIUM

Key Information:

Vendor
Red Hat
Status
Ovirt-engine-extension-aaa-jdbc
Vendor
CVE Published:
27 July 2018

Summary

When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accounts with expired passwords, gaining access to those accounts.

Affected Version(s)

ovirt-engine-extension-aaa-jdbc 1.1.3

References

http://rhn.redhat.com/errata/RHSA-2017-0257.html
vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2614
x_refsource_CONFIRM

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.