CVE-2016-4457 — CFME: default certificate used across all installs

Back Back to CVE browser

HIGH

CFME: default certificate used across all installs

Published Jun 8, 2017

7.5

HIGH

CVSS 3.0

EPSS 1.06%

Description

CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.

Affected products

CloudForms Management Engine 5.7

cfme-0:5.7.3.2-1.el7cf

Fixed · RHSA-2017:1601
CloudForms Management Engine 5.7

cfme-appliance-0:5.7.3.2-1.el7cf

Fixed · RHSA-2017:1601
CloudForms Management Engine 5.7

cfme-gemset-0:5.7.3.2-1.el7cf

Fixed · RHSA-2017:1601
CloudForms Management Engine 5.7

rh-ruby23-rubygem-nokogiri-0:1.7.2-1.el7cf

Fixed · RHSA-2017:1601
CloudForms Management Engine 5.7

rh-ruby23-rubygem-ovirt-engine-sdk4-0:4.1.5-1.el7cf

Fixed · RHSA-2017:1601
CloudForms Management Engine 5.8

ansible-0:2.2.1.0-2.el7

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

ansible-tower-0:3.1.2-1.el7at

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

bubblewrap-0:0.1.7-1.el7

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

cfme-0:5.8.0.17-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

cfme-appliance-0:5.8.0.17-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

cfme-gemset-0:5.8.0.17-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

erlang-0:19.0.4-1.el7at

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

freeipmi-0:1.5.1-2.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

google-compute-engine-0:2.0.0-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

google-config-0:2.0.0-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

libtomcrypt-0:1.17-23.el7

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

libtommath-0:0.42.0-4.el7

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

nginx-1:1.10.2-1.el7at

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

postgresql94-0:9.4.11-2PGDG.el7at

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

prince-0:9.0r2-10.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

python-crypto-0:2.6.1-7.el7

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

python-ecdsa-0:0.11-4.el7

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

python-httplib2-0:0.9.1-2.1.el7

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

python-keyczar-0:0.71c-2.el7

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

python-meld3-0:0.6.10-1.el7

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

python-paramiko-0:1.15.2-3.el7

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

python-passlib-0:1.6.5-1.1.el7

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rabbitmq-server-0:3.6.5-1.el7at

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-postgresql95-postgresql-pglogical-0:1.2.1-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-postgresql95-repmgr-0:3.1.3-2.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-bcrypt-0:3.1.10-3.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-eventmachine-0:1.0.7-6.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-ffi-0:1.9.8-4.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-hamlit-0:2.7.2-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-http_parser.rb-0:0.6.0-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-json-0:2.0.2-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-linux_block_device-0:0.2.1-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-memory_buffer-0:0.1.0-2.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-net_app_manageability-0:0.1.0-3.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-nio4r-0:1.2.1-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-nokogiri-0:1.6.8-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-ovirt-engine-sdk4-0:4.1.5-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-pg-0:0.18.2-5.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-pkg-config-0:1.1.7-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-puma-0:3.3.0-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-redhat_access_cfme-0:1.1.0-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-redhat_access_lib-0:0.1.0-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-rugged-0:0.25.0-b10.2.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-thin-0:1.7.0-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-unf_ext-0:0.0.7.1-3.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

rh-ruby23-rubygem-websocket-driver-0:0.6.3-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

smem-0:1.4-1.el7cf

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

sshpass-0:1.06-1.el7

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

supervisor-0:3.1.3-3.el7

Fixed · RHSA-2017:1367
CloudForms Management Engine 5.8

wmi-0:1.3.14-7.el7cf

Fixed · RHSA-2017:1367

Product	Package	State	Advisory
CloudForms Management Engine 5.7	cfme-0:5.7.3.2-1.el7cf	Fixed	RHSA-2017:1601
CloudForms Management Engine 5.7	cfme-appliance-0:5.7.3.2-1.el7cf	Fixed	RHSA-2017:1601
CloudForms Management Engine 5.7	cfme-gemset-0:5.7.3.2-1.el7cf	Fixed	RHSA-2017:1601
CloudForms Management Engine 5.7	rh-ruby23-rubygem-nokogiri-0:1.7.2-1.el7cf	Fixed	RHSA-2017:1601
CloudForms Management Engine 5.7	rh-ruby23-rubygem-ovirt-engine-sdk4-0:4.1.5-1.el7cf	Fixed	RHSA-2017:1601
CloudForms Management Engine 5.8	ansible-0:2.2.1.0-2.el7	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	ansible-tower-0:3.1.2-1.el7at	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	bubblewrap-0:0.1.7-1.el7	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	cfme-0:5.8.0.17-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	cfme-appliance-0:5.8.0.17-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	cfme-gemset-0:5.8.0.17-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	erlang-0:19.0.4-1.el7at	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	freeipmi-0:1.5.1-2.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	google-compute-engine-0:2.0.0-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	google-config-0:2.0.0-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	libtomcrypt-0:1.17-23.el7	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	libtommath-0:0.42.0-4.el7	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	nginx-1:1.10.2-1.el7at	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	postgresql94-0:9.4.11-2PGDG.el7at	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	prince-0:9.0r2-10.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	python-crypto-0:2.6.1-7.el7	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	python-ecdsa-0:0.11-4.el7	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	python-httplib2-0:0.9.1-2.1.el7	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	python-keyczar-0:0.71c-2.el7	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	python-meld3-0:0.6.10-1.el7	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	python-paramiko-0:1.15.2-3.el7	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	python-passlib-0:1.6.5-1.1.el7	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rabbitmq-server-0:3.6.5-1.el7at	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-postgresql95-postgresql-pglogical-0:1.2.1-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-postgresql95-repmgr-0:3.1.3-2.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-bcrypt-0:3.1.10-3.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-eventmachine-0:1.0.7-6.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-ffi-0:1.9.8-4.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-hamlit-0:2.7.2-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-http_parser.rb-0:0.6.0-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-json-0:2.0.2-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-linux_block_device-0:0.2.1-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-memory_buffer-0:0.1.0-2.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-net_app_manageability-0:0.1.0-3.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-nio4r-0:1.2.1-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-nokogiri-0:1.6.8-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-ovirt-engine-sdk4-0:4.1.5-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-pg-0:0.18.2-5.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-pkg-config-0:1.1.7-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-puma-0:3.3.0-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-redhat_access_cfme-0:1.1.0-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-redhat_access_lib-0:0.1.0-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-rugged-0:0.25.0-b10.2.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-thin-0:1.7.0-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-unf_ext-0:0.0.7.1-3.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	rh-ruby23-rubygem-websocket-driver-0:0.6.3-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	smem-0:1.4-1.el7cf	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	sshpass-0:1.06-1.el7	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	supervisor-0:3.1.3-3.el7	Fixed	RHSA-2017:1367
CloudForms Management Engine 5.8	wmi-0:1.3.14-7.el7cf	Fixed	RHSA-2017:1367

Remediation

No remediation recorded yet.

Metrics

1.06% 0.01058

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01058

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.06% (0.01058)	63.21th	v5 (v2026.06.15)
Jun 15, 2026	1.06% (0.01058)	59.92th	v5 (v2026.06.15)
Mar 17, 2025	0.20% (0.00197)	39.65th	v4 (v2025.03.14)
Dec 12, 2024	0.13% (0.00133)	50.05th	v3 (v2023.03.01)
Jun 14, 2024	0.13% (0.00133)	48.59th	v3 (v2023.03.01)
Mar 7, 2023	0.13% (0.00133)	46.56th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Sep 10, 2022	1.02% (0.01018)	38.88th	v2 (v2022.01.01)
Apr 1, 2022	1.02% (0.01018)	36.86th	v2 (v2022.01.01)
Feb 4, 2022	1.02% (0.01018)	19.50th	v2 (v2022.01.01)

Weaknesses (2)

CWE-310

CWE-798

Hard-coded Credentials

References (7)

http://www.securitytracker.com/id/1038599
vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2017:1367
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1601
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2016-4457
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1341308
x_refsource_CONFIRMIssue TrackingVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-4457
https://www.cve.org/CVERecord?id=CVE-2016-4457

Link	Providers	Tags
http://www.securitytracker.com/id/1038599		vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2017:1367		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1601		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2016-4457		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1341308		x_refsource_CONFIRMIssue TrackingVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-4457
https://www.cve.org/CVERecord?id=CVE-2016-4457