CVE-2014-3706 Security feature bypass in n/a

What is CVE-2014-3706?

CVE-2014-3706 is a medium-severity vulnerability in Redhat Enterprise Mrg, published on 18 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates.

Weakness: CWE-295

Which versions are affected by CVE-2014-3706?

It affects 1 product.

Products include Redhat Enterprise Mrg.

How do I fix CVE-2014-3706?

No fix has been published for CVE-2014-3706 yet. Limit exposure of the affected software until one is available.

Is CVE-2014-3706 being exploited?

There is no known exploitation of CVE-2014-3706 in the wild and no public exploit code.

Other vulnerabilities in Redhat Enterprise Mrg

• CVE-2012-3460 Hardcoded credentials in cumin Critical 9.8
• CVE-2013-4461 SQL injection in n/a High 7.5
• CVE-2012-2684 SQL injection in n/a High 7.5
• CVE-2010-4179 Missing authorization in n/a High 7.5
• CVE-2013-4405 Cross-site request forgery in n/a Medium 6.8

All Redhat Enterprise Mrg vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g7pg-wj9c-h3j9.