Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 515
Alerts This Week
Warning Icon 1 515

Red Hat: RHSA-2018:2071-01 Moderate: Virtualization Manager Security Update

red hat
Calendar Grey June 27, 2018
Scroller Redhat
The Blue Shield Cloud Orchestrator has received a significant system patch fixing several vulnerabilities and introducing improvements.
An update for org.ovirt.engine-root is now available for Red Hat Virtualization Manager 4.2

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891

Summary

The Red Hat Virtualization Manager is a centralized management platform that allows system administrators to view and manage virtual machines. The Manager provides a comprehensive range of features including search capabilities, resource management, live migrations, and virtual infrastructure provisioning.
The Manager is a JBoss Application Server application that provides several interfaces through which the virtual environment can be accessed and interacted with, including an Administration Portal, a User Portal, and a Representational State Transfer (REST) Application Programming Interface (API).
The following packages have been upgraded to a later version:
* org.ovirt.engine-root (4.2.4.5). (BZ#1576752)
Security Fix(es):
* ovirt-engine: Unfiltered password when choosing manual db provisioning (CVE-2018-1075)
* ovirt-engine-setup: unfiltered db password in engine-backup log (CVE-2018-1072)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
These issues were discovered by Yedidyah Bar David (Red Hat).
Bug Fix(es):
* This update enables engine-setup to upgrade PostgreSQL 9.2 to 9.5, even when the locale of the 9.2 database is different from the system locale. (BZ#1579268)
* This update fixes an inefficient query that is generated when users click on the 'Users' tab in the Administration Portal. The fix ensures that the tab loads quicker. (BZ#1583619)
Enhancement(s):
* The storage domain's General sub-tab in the Administration Portal now shows the number of images on the storage domain under the rubric "Images", this corresponds to the number of LVs on a block domain. (BZ#1587885)

Topics%20covered

Topics Covered

security advisory moderate bug fix password security centralized management Red Hat Virtualization database provisioning

References

https://access.redhat.com/security/cve/CVE-2018-1072 https://access.redhat.com/security/cve/CVE-2018-1075 https://access.redhat.com/security/updates/classification/#moderate

Package List

RHV-M 4.2:
Source: ovirt-engine-4.2.4.5-0.1.el7_3.src.rpm
noarch: ovirt-engine-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-backend-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-dbscripts-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-extensions-api-impl-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-extensions-api-impl-javadoc-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-health-check-bundler-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-lib-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-restapi-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-setup-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-setup-base-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-setup-plugin-ovirt-engine-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-setup-plugin-ovirt-engine-common-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-setup-plugin-vmconsole-proxy-helper-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-setup-plugin-websocket-proxy-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-tools-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-tools-backup-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-vmconsole-proxy-helper-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-webadmin-portal-4.2.4.5-0.1.el7_3.noarch.rpm ovirt-engine-websocket-proxy-4.2.4.5-0.1.el7_3.noarch.rpm rhvm-4.2.4.5-0.1.el7_3.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and

Read the Full Advisory


Advisory ID: RHSA-2018:2071-01
Product: Red Hat Virtualization
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2071
Issue date: 2018-06-27

Topic

An update for org.ovirt.engine-root is now available for Red HatVirtualization Manager 4.2.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate bug fix password security centralized management Red Hat Virtualization database provisioning

Relevant Releases Architectures

RHV-M 4.2 - noarch

Bugs Fixed

1098612 - [donstream clone 4.2.4] [RFE] filter for "Allocation Policy" in Disks search

1251468 - [RFE] Additional warning when removing required networks

1542508 - CVE-2018-1075 ovirt-engine: Unfiltered password when choosing manual db provisioning

1575081 - VMs will fail to start in a cluster which is having display network having name greater than 15 characters1576352 - rhvm-4.2 reports "no updates found" although there is available updates

1576752 - Number of "Prestarted VMs" is ignored and all VMs of Pool starts after editing existing Pool.

1579268 - Upgrade of PostgreSQL during RHV 4.1 to 4.2 upgrade fails with locale mismatch

1582822 - [UI] - Interface name is gone in the Network Interfaces sub tab

1583579 - [downstream clone - 4.2.4] Very slow UI if Host has many (~64) elements (VFs or dummies or networks)

1583619 - [downstream clone - 4.2.4] [SCALE] Listing users in Users tab overloads the postgresql DB (CPU)

1584885 - VM remains migrating forever with no Host (actually doesn't exist) after StopVmCommand fails to DestroyVDS

1585013 - [downstream clone - 4.2.4] ovirt-engine loses track of a cancelled disk

1585039 - [downstream clone - 4.2.4] Live Storage Migration continued on after snapshot creation hung and timed out

1585157 - [downstream clone - 4.2.4] [UI] - VM's network interface name and icon too large and wrap

1585454 - [downstream clone - 4.2.4] Uploaded image: Virtual Size of qcow2 image is not reflected at guest OS level

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.