Medium severity · published Oct 18, 2017
CVE-2014-3706
ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates
5.9
CVSS
0.7%
EPSS
No
On KEV
Description
ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Enterprise Mrg · Redhat
3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3706
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3706
Third Party Advisory
http://www.securityfocus.com/bid/101507
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1154977
More from Enterprise Mrg
9.8
CVE-2012-3460
cumin: At installation postgresql database user created without password
8.0
CVE-2018-16884
A flaw was found in the Linux kernel's NFS41+ subsystem
7.8
CVE-2020-27786
A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a…
7.8
CVE-2020-10757
A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages
7.8
CVE-2017-7482
In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field