{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated rhevm-log-collector package that fixes one security issue is now\navailable for Red Hat Enterprise Virtualization 3.\n\nRed Hat Product Security has rated this update as having Low security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The rhevm-log-collector utility allows users to easily collect log files\nfrom all systems in their Red Hat Enterprise Virtualization environment.\n\nIt was found that rhevm-log-collector called sosreport with the PostgreSQL\ndatabase password passed as a command line parameter. A local attacker\ncould read this password by monitoring a process listing. The password\nwould also be written to a log file, which could potentially be read by a\nlocal attacker. (CVE-2014-3561)\n\nThis issue was discovered by David Jorm of Red Hat Product Security.\n\nAll rhevm-log-collector users are advised to upgrade to this updated\npackage, which contains a backported patch to correct this issue.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:1947",
        "url": "https://access.redhat.com/errata/RHSA-2014:1947"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "1122781",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1122781"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1947.json"
      }
    ],
    "title": "Red Hat Security Advisory: rhevm-log-collector security update",
    "tracking": {
      "current_release_date": "2026-06-28T12:09:24+00:00",
      "generator": {
        "date": "2026-06-28T12:09:24+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.2.6"
        }
      },
      "id": "RHSA-2014:1947",
      "initial_release_date": "2014-12-02T20:26:37+00:00",
      "revision_history": [
        {
          "date": "2014-12-02T20:26:37+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-12-02T20:26:37+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-28T12:09:24+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHEV-M 3.4",
                "product": {
                  "name": "RHEV-M 3.4",
                  "product_id": "6Server-RHEV-S-3.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhev_manager:3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhevm-log-collector-0:3.4.5-2.el6ev.noarch",
                "product": {
                  "name": "rhevm-log-collector-0:3.4.5-2.el6ev.noarch",
                  "product_id": "rhevm-log-collector-0:3.4.5-2.el6ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-log-collector@3.4.5-2.el6ev?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhevm-log-collector-0:3.4.5-2.el6ev.src",
                "product": {
                  "name": "rhevm-log-collector-0:3.4.5-2.el6ev.src",
                  "product_id": "rhevm-log-collector-0:3.4.5-2.el6ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-log-collector@3.4.5-2.el6ev?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-log-collector-0:3.4.5-2.el6ev.noarch as a component of RHEV-M 3.4",
          "product_id": "6Server-RHEV-S-3.4:rhevm-log-collector-0:3.4.5-2.el6ev.noarch"
        },
        "product_reference": "rhevm-log-collector-0:3.4.5-2.el6ev.noarch",
        "relates_to_product_reference": "6Server-RHEV-S-3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-log-collector-0:3.4.5-2.el6ev.src as a component of RHEV-M 3.4",
          "product_id": "6Server-RHEV-S-3.4:rhevm-log-collector-0:3.4.5-2.el6ev.src"
        },
        "product_reference": "rhevm-log-collector-0:3.4.5-2.el6ev.src",
        "relates_to_product_reference": "6Server-RHEV-S-3.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Jorm"
          ],
          "organization": "Red Hat Product Security",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2014-3561",
      "cwe": {
        "id": "CWE-522",
        "name": "Insufficiently Protected Credentials"
      },
      "discovery_date": "2014-07-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1122781"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that rhevm-log-collector called sosreport with the PostgreSQL database password passed as a command line parameter. A local attacker could read this password by monitoring a process listing. The password would also be written to a log file, which could potentially be read by a local attacker.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ovirt-engine-log-collector: database password disclosed in process listing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHEV-S-3.4:rhevm-log-collector-0:3.4.5-2.el6ev.noarch",
          "6Server-RHEV-S-3.4:rhevm-log-collector-0:3.4.5-2.el6ev.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-3561"
        },
        {
          "category": "external",
          "summary": "RHBZ#1122781",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1122781"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-3561",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-3561"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3561",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3561"
        }
      ],
      "release_date": "2014-12-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-12-02T20:26:37+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHEV-S-3.4:rhevm-log-collector-0:3.4.5-2.el6ev.noarch",
            "6Server-RHEV-S-3.4:rhevm-log-collector-0:3.4.5-2.el6ev.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1947"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 3.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-RHEV-S-3.4:rhevm-log-collector-0:3.4.5-2.el6ev.noarch",
            "6Server-RHEV-S-3.4:rhevm-log-collector-0:3.4.5-2.el6ev.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "ovirt-engine-log-collector: database password disclosed in process listing"
    }
  ]
}