{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated rhevm-dwh package that fixes one security issue and two bugs is\nnow available.\n\nThe Red Hat Security Response Team has rated this update as having Low\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Red Hat Enterprise Virtualization Manager data warehouse package\nprovides the Extract-Transform-Load (ETL) process and database scripts to\ncreate a historic database API. It also provides SQL BI reports creation\nfor management and monitoring.\n\nIt was found that the ovirt-engine-dwh setup script logged the history\ndatabase password in plain text to a world-readable file. An attacker with\na local user account on the Red Hat Enterprise Virtualization Manager\nserver could use this flaw to access, read, and modify the reports\ndatabase. (CVE-2014-0202)\n\nNote: Applying the update provided by this advisory does not modify any\nexisting log files. It is recommended that you search your existing log\nfiles and remove any occurrences of plain text passwords manually.\n\nThis issue was discovered by Red Hat.\n\nThis update also fixes the following bugs:\n\n* Previously, the read-only user and custom users for the data warehouse\ndatabase would lose access to views in the database when the database was\nupgraded. This was caused by the views being regenerated when the database\nwas upgraded and the permissions for those views not being applied to the\nnewly generated views. Now, user permissions are retained when the database\nis upgraded. (BZ#1078129)\n\n* Previously, the ovirt-engine-dwh-setup command would fail under certain\nconditions if the pg_hba.conf file had been manually edited prior to\nrunning that command. This was caused by the setup process checking the\nexact number of spaces in between values on the line corresponding to\n\u0027local\u0027. Now, the logic for checking the values in that line has been\nrevised so that the setup process can correctly read all values regardless\nof the number of spaces. (BZ#1084760)\n\nAll rhevm-dwh users are advised to upgrade to this updated package, which\ncorrects these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0559",
        "url": "https://access.redhat.com/errata/RHSA-2014:0559"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "1078129",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1078129"
      },
      {
        "category": "external",
        "summary": "1084760",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1084760"
      },
      {
        "category": "external",
        "summary": "1094234",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1094234"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0559.json"
      }
    ],
    "title": "Red Hat Security Advisory: rhevm-dwh 3.3.3 security and bug fix update",
    "tracking": {
      "current_release_date": "2025-11-21T17:48:24+00:00",
      "generator": {
        "date": "2025-11-21T17:48:24+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHSA-2014:0559",
      "initial_release_date": "2014-05-27T16:20:16+00:00",
      "revision_history": [
        {
          "date": "2014-05-27T16:20:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-05-27T16:20:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T17:48:24+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHEV-M 3.3",
                "product": {
                  "name": "RHEV-M 3.3",
                  "product_id": "6Server-RHEV-S-3.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhev_manager:3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhevm-dwh-0:3.3.3-1.el6ev.noarch",
                "product": {
                  "name": "rhevm-dwh-0:3.3.3-1.el6ev.noarch",
                  "product_id": "rhevm-dwh-0:3.3.3-1.el6ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-dwh@3.3.3-1.el6ev?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhevm-dwh-0:3.3.3-1.el6ev.src",
                "product": {
                  "name": "rhevm-dwh-0:3.3.3-1.el6ev.src",
                  "product_id": "rhevm-dwh-0:3.3.3-1.el6ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-dwh@3.3.3-1.el6ev?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-dwh-0:3.3.3-1.el6ev.noarch as a component of RHEV-M 3.3",
          "product_id": "6Server-RHEV-S-3.3:rhevm-dwh-0:3.3.3-1.el6ev.noarch"
        },
        "product_reference": "rhevm-dwh-0:3.3.3-1.el6ev.noarch",
        "relates_to_product_reference": "6Server-RHEV-S-3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-dwh-0:3.3.3-1.el6ev.src as a component of RHEV-M 3.3",
          "product_id": "6Server-RHEV-S-3.3:rhevm-dwh-0:3.3.3-1.el6ev.src"
        },
        "product_reference": "rhevm-dwh-0:3.3.3-1.el6ev.src",
        "relates_to_product_reference": "6Server-RHEV-S-3.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-0202",
      "cwe": {
        "id": "CWE-522",
        "name": "Insufficiently Protected Credentials"
      },
      "discovery_date": "2014-04-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1094234"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The setup script in ovirt-engine-dwh, as used in the Red Hat Enterprise Virtualization Manager data warehouse (rhevm-dwh) package before 3.3.3, stores the history database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ovirt-engine-dwh: setup script logs database password in cleartext",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHEV-S-3.3:rhevm-dwh-0:3.3.3-1.el6ev.noarch",
          "6Server-RHEV-S-3.3:rhevm-dwh-0:3.3.3-1.el6ev.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-0202"
        },
        {
          "category": "external",
          "summary": "RHBZ#1094234",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1094234"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0202",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-0202"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0202",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0202"
        }
      ],
      "release_date": "2014-05-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-05-27T16:20:16+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "6Server-RHEV-S-3.3:rhevm-dwh-0:3.3.3-1.el6ev.noarch",
            "6Server-RHEV-S-3.3:rhevm-dwh-0:3.3.3-1.el6ev.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0559"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-RHEV-S-3.3:rhevm-dwh-0:3.3.3-1.el6ev.noarch",
            "6Server-RHEV-S-3.3:rhevm-dwh-0:3.3.3-1.el6ev.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "ovirt-engine-dwh: setup script logs database password in cleartext"
    }
  ]
}