CVE-2014-8167 Security feature bypass in vdsm and vdsclient

What is CVE-2014-8167?

CVE-2014-8167 is a medium-severity vulnerability in vdsm and vdsclient, published on 13 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack

Weakness: CWE-295

Which versions are affected by CVE-2014-8167?

It affects 3 products.

Products include Redhat Enterprise Virtualization, Redhat Vdsclient, Redhat Virtual Desktop Server Manager.

How do I fix CVE-2014-8167?

No fix has been published for CVE-2014-8167 yet. Limit exposure of the affected software until one is available.

Is CVE-2014-8167 being exploited?

There is no known exploitation of CVE-2014-8167 in the wild and no public exploit code.

Other vulnerabilities in vdsm and vdsclient

• CVE-2015-5201 Auth bypass in Enterprise Virtualization Hypervisor (aka RHEV-H) High 7.5
• CVE-2013-2151 Privilege escalation in n/a High 7.2
• CVE-2013-2152 Privilege escalation in n/a High 7.2
• CVE-2013-2176 Privilege escalation in n/a High 7.2
• CVE-2017-2614 Auth bypass in ovirt-engine-extension-aaa-jdbc Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h68j-mvrw-qh9v.