Skip to content
Fencer Intel
high 7.5

CVE-2014-3674 json

Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, which allows remote attackers to access the network res…

published 11y ago modified 4mo ago also EUVD-2014-3622

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, which allows remote attackers to access the network resources of arbitrary gears via unspecified vectors.

Patch / fix

  • gd openshift 2.0 2.0.35-11.el6
  • js openshift 2.0 1.70-12.el6op
  • v8 openshift 2.0 1:3.14.5.10-2.el6op
  • icu openshift 2.0 4.2.1-9.1.el6_2
  • php openshift 2.0 5.3.3-38.el6
  • rhc openshift 2.0 1.31.3.1-1.el6op
  • gdal openshift 2.0 1.9.2-8.el6op
  • geos openshift 2.0 3.3.2-1.el6op

red hat advisories RHSA-2014:1796RHSA-2014:1906

Is CVE-2014-3674 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-3674 updated cvss 3.6

Enterprise: gears fail to properly isolate network traffic

  • Red Hat OpenShift Enterprise Client 2.2 rhc 1.31.3.1-1.el6op, rubygems 1.8.24-6.el6op, rubygem-open4 1.3.0-2.el6op, rubygem-net-scp 1.1.2-2.el6op, rubygem-net-ssh 2.7.0-1.el6op, rubygem-commander 4.0.3-4.el6op, +7 more Red Hat OpenShift Enterprise Infrastructure 2.2 js 1.70-12.el6op, libev 4.04-4.el6op, json-c 0.10-3.el6op, v8 3.14.5.10-2.el6op, libestr 0.1.9-2.el6op, mongodb 2.4.6-2.el6op, +121 more Red Hat OpenShift Enterprise JBoss EAP add-on 2.2 openshift-origin-cartridge-jbosseap 2.21.1.0-1.el6op, openshift-origin-cartridge-dependencies-optional-jbosseap 1.27.1.0-1.el6op, openshift-origin-cartridge-dependencies-recommended-jbosseap 1.27.1.0-1.el6op Red Hat OpenShift Enterprise Node 2.2 maven3 3.0.3-4, lcms 1.19-1.el6, gd 2.0.35-11.el6, js 1.70-12.el6op, php 5.3.3-38.el6, atlas 3.8.4-2.el6, +262 more
    fixed: vendor fix RHSA-2014:1796
  • Red Hat RHOSE Infrastructure 2.1 openshift-origin-broker 1.16.1.14-1.el6op, openshift-enterprise-release 2.1.9-1.el6op, openshift-enterprise-upgrade 2.1.9-1.el6op, openshift-origin-broker-util 1.23.8.14-1.el6op, openshift-enterprise-yum-validator 2.1.9-1.el6op, openshift-enterprise-upgrade-broker 2.1.9-1.el6op, +2 more Red Hat RHOSE JBoss EAP add-on 2.1 openshift-origin-cartridge-jbosseap 2.16.3.7-1.el6op Red Hat RHOSE Node 2.1 openshift-enterprise-release 2.1.9-1.el6op, openshift-enterprise-upgrade 2.1.9-1.el6op, openshift-origin-node-util 1.22.20.5-1.el6op, openshift-enterprise-upgrade-node 2.1.9-1.el6op, rubygem-openshift-origin-node 1.23.9.26-1.el6op, openshift-enterprise-yum-validator 2.1.9-1.el6op, +6 more
    fixed: vendor fix RHSA-2014:1906

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.06% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.