RHEL 6 : rhevm-dwh 3.3.3 (RHSA-2014:0559)

Low Nessus Plugin ID 79023


The remote Red Hat host is missing a security update.


An updated rhevm-dwh package that fixes one security issue and two bugs is now available.

The Red Hat Security Response Team has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Red Hat Enterprise Virtualization Manager data warehouse package provides the Extract-Transform-Load (ETL) process and database scripts to create a historic database API. It also provides SQL BI reports creation for management and monitoring.

It was found that the ovirt-engine-dwh setup script logged the history database password in plain text to a world-readable file. An attacker with a local user account on the Red Hat Enterprise Virtualization Manager server could use this flaw to access, read, and modify the reports database. (CVE-2014-0202)

Note: Applying the update provided by this advisory does not modify any existing log files. It is recommended that you search your existing log files and remove any occurrences of plain text passwords manually.

This issue was discovered by Red Hat.

This update also fixes the following bugs :

* Previously, the read-only user and custom users for the data warehouse database would lose access to views in the database when the database was upgraded. This was caused by the views being regenerated when the database was upgraded and the permissions for those views not being applied to the newly generated views. Now, user permissions are retained when the database is upgraded. (BZ#1078129)

* Previously, the ovirt-engine-dwh-setup command would fail under certain conditions if the pg_hba.conf file had been manually edited prior to running that command. This was caused by the setup process checking the exact number of spaces in between values on the line corresponding to 'local'. Now, the logic for checking the values in that line has been revised so that the setup process can correctly read all values regardless of the number of spaces. (BZ#1084760)

All rhevm-dwh users are advised to upgrade to this updated package, which corrects these issues.


Update the affected rhevm-dwh package.

See Also



Plugin Details

Severity: Low

ID: 79023

File Name: redhat-RHSA-2014-0559.nasl

Version: $Revision: 1.6 $

Type: local

Agent: unix

Published: 2014/11/08

Modified: 2017/01/06

Dependencies: 12634

Risk Information

Risk Factor: Low


Base Score: 2.1

Temporal Score: 1.8

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:rhevm-dwh, cpe:/o:redhat:enterprise_linux:6

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2014/05/27

Reference Information

CVE: CVE-2014-0202

BID: 67690

RHSA: 2014:0559