Vulnerability-Lookup

RHSA-2014:1947

Vulnerability from csaf_redhat - Published: 2014-12-02 20:26 - Updated: 2025-11-21 17:51

Summary

Red Hat Security Advisory: rhevm-log-collector security update

Notes

Topic

An updated rhevm-log-collector package that fixes one security issue is now available for Red Hat Enterprise Virtualization 3. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Details

The rhevm-log-collector utility allows users to easily collect log files from all systems in their Red Hat Enterprise Virtualization environment. It was found that rhevm-log-collector called sosreport with the PostgreSQL database password passed as a command line parameter. A local attacker could read this password by monitoring a process listing. The password would also be written to a log file, which could potentially be read by a local attacker. (CVE-2014-3561) This issue was discovered by David Jorm of Red Hat Product Security. All rhevm-log-collector users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated rhevm-log-collector package that fixes one security issue is now\navailable for Red Hat Enterprise Virtualization 3.\n\nRed Hat Product Security has rated this update as having Low security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The rhevm-log-collector utility allows users to easily collect log files\nfrom all systems in their Red Hat Enterprise Virtualization environment.\n\nIt was found that rhevm-log-collector called sosreport with the PostgreSQL\ndatabase password passed as a command line parameter. A local attacker\ncould read this password by monitoring a process listing. The password\nwould also be written to a log file, which could potentially be read by a\nlocal attacker. (CVE-2014-3561)\n\nThis issue was discovered by David Jorm of Red Hat Product Security.\n\nAll rhevm-log-collector users are advised to upgrade to this updated\npackage, which contains a backported patch to correct this issue.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:1947",
        "url": "https://access.redhat.com/errata/RHSA-2014:1947"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "1122781",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1122781"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1947.json"
      }
    ],
    "title": "Red Hat Security Advisory: rhevm-log-collector security update",
    "tracking": {
      "current_release_date": "2025-11-21T17:51:01+00:00",
      "generator": {
        "date": "2025-11-21T17:51:01+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHSA-2014:1947",
      "initial_release_date": "2014-12-02T20:26:37+00:00",
      "revision_history": [
        {
          "date": "2014-12-02T20:26:37+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-12-02T20:26:37+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T17:51:01+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHEV-M 3.4",
                "product": {
                  "name": "RHEV-M 3.4",
                  "product_id": "6Server-RHEV-S-3.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhev_manager:3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhevm-log-collector-0:3.4.5-2.el6ev.noarch",
                "product": {
                  "name": "rhevm-log-collector-0:3.4.5-2.el6ev.noarch",
                  "product_id": "rhevm-log-collector-0:3.4.5-2.el6ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-log-collector@3.4.5-2.el6ev?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhevm-log-collector-0:3.4.5-2.el6ev.src",
                "product": {
                  "name": "rhevm-log-collector-0:3.4.5-2.el6ev.src",
                  "product_id": "rhevm-log-collector-0:3.4.5-2.el6ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-log-collector@3.4.5-2.el6ev?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-log-collector-0:3.4.5-2.el6ev.noarch as a component of RHEV-M 3.4",
          "product_id": "6Server-RHEV-S-3.4:rhevm-log-collector-0:3.4.5-2.el6ev.noarch"
        },
        "product_reference": "rhevm-log-collector-0:3.4.5-2.el6ev.noarch",
        "relates_to_product_reference": "6Server-RHEV-S-3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-log-collector-0:3.4.5-2.el6ev.src as a component of RHEV-M 3.4",
          "product_id": "6Server-RHEV-S-3.4:rhevm-log-collector-0:3.4.5-2.el6ev.src"
        },
        "product_reference": "rhevm-log-collector-0:3.4.5-2.el6ev.src",
        "relates_to_product_reference": "6Server-RHEV-S-3.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Jorm"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-3561",
      "cwe": {
        "id": "CWE-522",
        "name": "Insufficiently Protected Credentials"
      },
      "discovery_date": "2014-07-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1122781"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that rhevm-log-collector called sosreport with the PostgreSQL database password passed as a command line parameter. A local attacker could read this password by monitoring a process listing. The password would also be written to a log file, which could potentially be read by a local attacker.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ovirt-engine-log-collector: database password disclosed in process listing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHEV-S-3.4:rhevm-log-collector-0:3.4.5-2.el6ev.noarch",
          "6Server-RHEV-S-3.4:rhevm-log-collector-0:3.4.5-2.el6ev.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3561"
        },
        {
          "category": "external",
          "summary": "RHBZ#1122781",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1122781"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3561",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3561"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3561",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3561"
        }
      ],
      "release_date": "2014-12-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-12-02T20:26:37+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHEV-S-3.4:rhevm-log-collector-0:3.4.5-2.el6ev.noarch",
            "6Server-RHEV-S-3.4:rhevm-log-collector-0:3.4.5-2.el6ev.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1947"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 3.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-RHEV-S-3.4:rhevm-log-collector-0:3.4.5-2.el6ev.noarch",
            "6Server-RHEV-S-3.4:rhevm-log-collector-0:3.4.5-2.el6ev.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "ovirt-engine-log-collector: database password disclosed in process listing"
    }
  ]
}

CVE-2014-3561 (GCVE-0-2014-3561)

Vulnerability from cvelistv5 – Published: 2014-12-05 16:00 – Updated: 2024-08-06 10:50

Summary

The rhevm-log-collector package in Red Hat Enterprise Virtualization 3.4 uses the PostgreSQL database password on the command line when calling sosreport, which allows local users to obtain sensitive information by listing the processes.

Severity ?

No CVSS data available.

CWE

Assigner

redhat

References

URL

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2014:1947

CVE-2014-3561 (GCVE-0-2014-3561)

Tags

Sightings

Nomenclature