CVE-2014-3561
Red Hat Enterprise Virtualization 3.4 - Exposure of Sensitive Information via rhevm-log-collector Command Line
Title source: llmDescription
The rhevm-log-collector package in Red Hat Enterprise Virtualization 3.4 uses the PostgreSQL database password on the command line when calling sosreport, which allows local users to obtain sensitive information by listing the processes.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/99096
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1031291
Vendor Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1947.html
Scores
EPSS
0.0037
EPSS Percentile
29.6%
Details
CWE
CWE-200
Status
published
Products (1)
redhat/enterprise_virtualization
3.4
Published
Dec 05, 2014
Tracked Since
Feb 18, 2026