Description
When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accounts with expired passwords, gaining access to those accounts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | ovirt-engine-extension-aaa-jdbc | 1.1.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | ovirt-engine-extension-aaa-jdbc | 1.1.3-1.el7ev | RHSA-2017:0257 |
Advisories 1
- RHSA-2017:0257 Red Hat Security Advisory: ovirt-engine-extension-aaa-jdbc security update Red Hat Security Advisories (RHSA) · Jul 1, 2026