{"id":"CVE-2013-6434","aliases":["EUVD-2013-6244","GHSA-fqrm-v269-v375","RHSA-2014:0038"],"status":"published","title":"The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a...","description":"The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a native SPICE client invocation method, initially makes insecure connections to the SPICE server, which allows man-in-the-middle attackers to spoof the SPICE server.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00968,"percentile":0.6205,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2014-01-24T18:00:00Z","modified":"2026-06-29T10:06:16Z","fixes":[{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm","fixed_in":["0:3.3.0-0.45.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-backend","fixed_in":["0:3.3.0-0.45.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-dbscripts","fixed_in":["0:3.3.0-0.45.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-lib","fixed_in":["0:3.3.0-0.45.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-restapi","fixed_in":["0:3.3.0-0.45.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup","fixed_in":["0:3.3.0-0.45.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup-plugin-allinone","fixed_in":["0:3.3.0-0.45.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-tools","fixed_in":["0:3.3.0-0.45.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-userportal","fixed_in":["0:3.3.0-0.45.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-webadmin-portal","fixed_in":["0:3.3.0-0.45.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-websocket-proxy","fixed_in":["0:3.3.0-0.45.el6ev"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-0.45.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-0.45.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-dbscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-0.45.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-0.45.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-restapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-0.45.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-0.45.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup-plugin-allinone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-0.45.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-0.45.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-userportal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-0.45.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-webadmin-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-0.45.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-websocket-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0-0.45.el6ev"}]}]}],"products":[{"vendor":"redhat","product":"enterprise_virtualization_manager"}],"references":[{"url":"http://www.securityfocus.com/bid/65077","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securitytracker.com/id/1029653","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0038.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6434","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039839","tags":["report"]},{"url":"https://github.com/advisories/GHSA-fqrm-v269-v375"},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.3/html/Technical_Notes/chap-RHSA-20140038_-_rhevm.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=618636","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=787578","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=825801","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=829672","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=835543","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=838456","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=838468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=838527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=853739","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=859727","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=863211","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=867642","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=872719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=873795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=879904","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=880773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=885135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=886840","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=889271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=890568","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=891056","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=892642","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=902353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=907491","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=908327","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=908656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=908835","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=909270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=909930","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=912076","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=912258","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=915778","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=915904","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=916832","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=916866","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=917586","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=918890","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=920694","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=921544","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=922475","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=922504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=922609","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=926928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=947977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=948481","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=948744","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=949281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=949484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=950768","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952107","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=952297","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=953614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=953989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=955498","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=957703","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=957729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=959879","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=960931","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=961645","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=962162","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=962177","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=965179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=966003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=966192","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=966198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=966980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=967268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=967278","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=967327","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=967328","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=967353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=967516","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=967541","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=967572","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=967573","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=967574","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=967604","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=967987","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=968178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=968499","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=970046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=970195","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=970948","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=971237","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=971346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=971695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=972455","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=973383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=974066","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=974148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=974982","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=975097","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=976671","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=977322","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=977689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=978268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=979763","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=980486","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=980926","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=982050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=982527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=982636","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=983120","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=983295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=985635","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=986700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=986979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=987783","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=988259","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=989041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=993123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=994218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=994463","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=995501","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996816","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=999812","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1000789","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1002401","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1002664","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1003117","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1004066","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1005256","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1006659","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1012798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1013860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1015148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1015638","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1018201","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1021326","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1023131","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1023952","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1028966","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1029106","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1029177","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1032807","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1037894","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0038.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6434","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-6434","description":"The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a native SPICE client invocation method, initially makes insecure connections to the SPICE server, which allows man-in-the-middle attackers to spoof the SPICE server.","status":"published","published":"2014-01-24T18:00:00Z","modified":"2024-08-06T17:39:01.295Z","updated_at":"2026-11-02T14:34:57.195423Z"}],"euvd":[{"id":"EUVD-2013-6244","description":"The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a native SPICE client invocation method, initially makes insecure connections to the SPICE server, which allows man-in-the-middle attackers to spoof the SPICE server.","status":"published","published":"2014-01-24T18:00:00Z","modified":"2024-08-06T17:39:01Z","updated_at":"2026-11-03T01:56:26.306678Z"}],"ghsa":[{"id":"GHSA-fqrm-v269-v375","title":"The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a...","description":"The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a native SPICE client invocation method, initially makes insecure connections to the SPICE server, which allows man-in-the-middle attackers to spoof the SPICE server.","status":"published","published":"2022-05-17T04:54:08Z","modified":"2023-02-10T05:06:22Z","updated_at":"2026-11-02T14:54:01.789224Z"}],"nvd":[{"id":"CVE-2013-6434","description":"The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a native SPICE client invocation method, initially makes insecure connections to the SPICE server, which allows man-in-the-middle attackers to spoof the SPICE server.","status":"published","published":"2014-01-24T18:55:04.337Z","modified":"2026-06-17T00:00:28.91Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"RHSA-2014:0038","title":"Red Hat Security Advisory: Red Hat Enterprise Virtualization Manager 3.3.0 update","status":"published","published":"2024-09-13T08:27:14Z","modified":"2026-06-29T10:06:16Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}