CVE-2017-2614

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accounts with expired passwords, gaining access to those accounts.

Metrics

CVSS 3.0 6.3/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-20CWE-640

Affected software

VendorProductVersions
Red Hatovirt-engine-extension-aaa-jdbc1.1.3

References

Timeline

Published
Jul 27, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-26159.1Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur whCVE-2017-26164.7A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attackCVE-2017-26177.8hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a craCVE-2017-26185.5A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty (null) write CVE-2017-26197.5Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the servCVE-2017-26209.9Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The isCVE-2017-26215.5An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory wCVE-2017-26225.5An accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperly made world readableCVE-2017-26235.3It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering.CVE-2017-26247.0It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. CVE-2017-26255.5It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a locCVE-2017-26265.5It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for sess
CVE-2017-2614: Medium severity, CVSS 6.3 | Vulnix