RedHat: RHSA-2019-2437:01 Important: Red Hat Virtualization security update
Summary
The redhat-virtualization-host packages provide the Red Hat Virtualization
Host. These packages include redhat-release-virtualization-host,
ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are
installed using a special build of Red Hat Enterprise Linux with only the
packages required to host virtual machines. RHVH features a Cockpit user
interface for monitoring the host's resources and performing administrative
tasks.
The following packages have been upgraded to a later upstream version:
imgbased (1.1.9), ovirt-node-ng (4.3.5), redhat-release-virtualization-host
(4.3.5), redhat-virtualization-host (4.3.5). (BZ#1669357, BZ#1669365,
BZ#1684986, BZ#1711193, BZ#1717250, BZ#1726917)
Security Fix(es):
* python: regression of CVE-2019-9636 due to functional fix to allow port
numbers in netloc (CVE-2019-10160)
* rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is
enabled (CVE-2018-16881)
* edk2: stack overflow in XHCI causing denial of service (CVE-2019-0161)
* openssl: 0-byte record padding oracle (CVE-2019-1559)
* cockpit-ovirt: admin and appliance passwords saved in plain text variable
file during HE deployment (CVE-2019-10139)
* sssd: improper implementation of GPOs due to too restrictive permissions
(CVE-2018-16838)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Summary
Solution
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/2974891
References
https://access.redhat.com/security/cve/CVE-2018-16838 https://access.redhat.com/security/cve/CVE-2018-16881 https://access.redhat.com/security/cve/CVE-2019-0161 https://access.redhat.com/security/cve/CVE-2019-1559 https://access.redhat.com/security/cve/CVE-2019-10139 https://access.redhat.com/security/cve/CVE-2019-10160 https://access.redhat.com/security/updates/classification/#important
Package List
Red Hat Virtualization 4 Hypervisor for RHEL 7:
Source:
redhat-virtualization-host-4.3.5-20190722.0.el7_7.src.rpm
noarch:
redhat-virtualization-host-image-update-4.3.5-20190722.0.el7_7.noarch.rpm
RHEL 7-based RHEV-H for RHEV 4 (build requirements):
Source:
imgbased-1.1.9-0.1.el7ev.src.rpm
ovirt-node-ng-4.3.5-0.20190717.0.el7ev.src.rpm
redhat-release-virtualization-host-4.3.5-2.el7ev.src.rpm
noarch:
imgbased-1.1.9-0.1.el7ev.noarch.rpm
ovirt-node-ng-nodectl-4.3.5-0.20190717.0.el7ev.noarch.rpm
python-imgbased-1.1.9-0.1.el7ev.noarch.rpm
python2-ovirt-node-ng-nodectl-4.3.5-0.20190717.0.el7ev.noarch.rpm
redhat-virtualization-host-image-update-placeholder-4.3.5-2.el7ev.noarch.rpm
x86_64:
redhat-release-virtualization-host-4.3.5-2.el7ev.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
Topic
An update for redhat-virtualization-host is now available for Red HatVirtualization 4 for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.
Topic
Relevant Releases Architectures
RHEL 7-based RHEV-H for RHEV 4 (build requirements) - noarch, x86_64
Red Hat Virtualization 4 Hypervisor for RHEL 7 - noarch
Bugs Fixed
1640820 - CVE-2018-16838 sssd: improper implementation of GPOs due to too restrictive permissions
1658366 - CVE-2018-16881 rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is enabled
1683804 - CVE-2019-1559 openssl: 0-byte record padding oracle
1687920 - RHVH fails to reinstall if required size is exceeding the available disk space due to anaconda bug
1694065 - CVE-2019-0161 edk2: stack overflow in XHCI causing denial of service
1702223 - Rebase RHV-H on RHEL 7.7
1709829 - CVE-2019-10139 cockpit-ovirt: admin and appliance passwords saved in plain text variable file during HE deployment
1718388 - CVE-2019-10160 python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
1720156 - RHVH 4.3.4 version info is incorrect in plymouth and "/etc/os-release"
1720160 - RHVH 4.3.4: Incorrect info in /etc/system-release-cpe
1720310 - RHV-H post-installation scripts failing, due to existing tags
1720434 - RHVH 7.7 brand is wrong in Anaconda GUI.
1720435 - Failed to install RHVH 7.7
1720436 - RHVH 7.7 should based on RHEL 7.7 server but not workstation.
1724044 - Failed dependencies occur during install systemtap package.
1726534 - dhclient fails to load libdns-export.so.1102 after upgrade if the user installed library is not persisted on the new layer
1727007 - Update RHVH 7.7 branding with new Red Hat logo
1727859 - Failed to boot after upgrading a host with a custom kernel
1728998 - "nodectl info" displays error after RHVH installation
1729023 - The error message is inappropriate when run `imgbase layout --init` on current layout
