CVE-2014-0104

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-in-the-middle attackers to spoof SSL servers via arbitrary SSL certificates.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
fence-agents	fence-agents	before 4.0.17

References

https://access.redhat.com/security/cve/cve-2014-0104Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0104Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-0104Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2014-0104Third Party Advisory
https://access.redhat.com/security/cve/cve-2014-0104Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0104Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-0104Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2014-0104Third Party Advisory

Timeline

Published: Jan 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-01056.0The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly ret CVE-2014-01066.6Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which all CVE-2014-01077.5The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESS CVE-2014-01094.3Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large reque CVE-2014-01104.3Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large in CVE-2014-01116.5Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to CVE-2014-01127.5ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers CVE-2014-01137.5CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getCla CVE-2014-01147.5Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requir CVE-2014-01157.5Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot do CVE-2014-01165.8CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the ge CVE-2014-01174.3The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a deni