CVE-2014-8164

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A insecure configuration for certificate verification (http.verify_mode = OpenSSL::SSL::VERIFY_NONE) may lead to verification bypass in Red Hat CloudForms 5.x.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
n/a	Red Hat CloudForms	Red Hat CloudForms 5.x

References

https://bugzilla.redhat.com/show_bug.cgi?id=1151208Issue Tracking, Mitigation, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1151208Issue Tracking, Mitigation, Third Party Advisory

Timeline

Published: Jul 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-816510.0scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute CVE-2014-81668.8The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attacke CVE-2014-81675.9vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack CVE-2014-81686.1Red Hat Satellite 6 allows local users to access mongod and delete pulp_database.CVE-2014-81694.4automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values in CVE-2014-81708.8ovirt_safe_delete_config in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterp CVE-2014-81715.5The memory resource controller (aka memcg) in the Linux kernel allows local users to cause a denial of service (deadlock) by spawning new pr CVE-2014-81724.9The filesystem implementation in the Linux kernel before 3.13 performs certain operations on lists of files with an inappropriate locking ap CVE-2014-81737.2The pmd_none_or_trans_huge_or_clear_bad function in include/asm-generic/pgtable.h in the Linux kernel before 3.13 on NUMA systems does not p CVE-2014-81749.8eDeploy makes it easier for remote attackers to execute arbitrary code by leveraging use of HTTP to download files.CVE-2014-81756.0Red Hat JBoss Fuse before 6.2.0 allows remote authenticated users to bypass intended restrictions and access the HawtIO console by leveragin CVE-2014-81767.5The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structure