RedHat: RHSA-2019-2437:01 Important: Red Hat Virtualization security update

    Date12 Aug 2019
    CategoryRed Hat
    850
    Posted ByLinuxSecurity Advisories
    An update for redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256
    
    =====================================================================
                       Red Hat Security Advisory
    
    Synopsis:          Important: Red Hat Virtualization security update
    Advisory ID:       RHSA-2019:2437-01
    Product:           Red Hat Virtualization
    Advisory URL:      https://access.redhat.com/errata/RHSA-2019:2437
    Issue date:        2019-08-12
    CVE Names:         CVE-2018-16838 CVE-2018-16881 CVE-2019-0161 
                       CVE-2019-1559 CVE-2019-10139 CVE-2019-10160 
    =====================================================================
    
    1. Summary:
    
    An update for redhat-virtualization-host is now available for Red Hat
    Virtualization 4 for Red Hat Enterprise Linux 7.
    
    Red Hat Product Security has rated this update as having a security impact
    of Important. A Common Vulnerability Scoring System (CVSS) base score,
    which gives a detailed severity rating, is available for each vulnerability
    from the CVE link(s) in the References section.
    
    2. Relevant releases/architectures:
    
    RHEL 7-based RHEV-H for RHEV 4 (build requirements) - noarch, x86_64
    Red Hat Virtualization 4 Hypervisor for RHEL 7 - noarch
    
    3. Description:
    
    The redhat-virtualization-host packages provide the Red Hat Virtualization
    Host. These packages include redhat-release-virtualization-host,
    ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are
    installed using a special build of Red Hat Enterprise Linux with only the
    packages required to host virtual machines. RHVH features a Cockpit user
    interface for monitoring the host's resources and performing administrative
    tasks.
    
    The following packages have been upgraded to a later upstream version:
    imgbased (1.1.9), ovirt-node-ng (4.3.5), redhat-release-virtualization-host
    (4.3.5), redhat-virtualization-host (4.3.5). (BZ#1669357, BZ#1669365,
    BZ#1684986, BZ#1711193, BZ#1717250, BZ#1726917)
    
    Security Fix(es):
    
    * python: regression of CVE-2019-9636 due to functional fix to allow port
    numbers in netloc (CVE-2019-10160)
    
    * rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is
    enabled (CVE-2018-16881)
    
    * edk2: stack overflow in XHCI causing denial of service (CVE-2019-0161)
    
    * openssl: 0-byte record padding oracle (CVE-2019-1559)
    
    * cockpit-ovirt: admin and appliance passwords saved in plain text variable
    file during HE deployment (CVE-2019-10139)
    
    * sssd: improper implementation of GPOs due to too restrictive permissions
    (CVE-2018-16838)
    
    For more details about the security issue(s), including the impact, a CVSS
    score, acknowledgments, and other related information, refer to the CVE
    page(s) listed in the References section.
    
    4. Solution:
    
    For details on how to apply this update, which includes the changes
    described in this advisory, refer to:
    
    https://access.redhat.com/articles/2974891
    
    5. Bugs fixed (https://bugzilla.redhat.com/):
    
    1640820 - CVE-2018-16838 sssd: improper implementation of GPOs due to too restrictive permissions
    1658366 - CVE-2018-16881 rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is enabled
    1683804 - CVE-2019-1559 openssl: 0-byte record padding oracle
    1687920 - RHVH fails to reinstall if required size is exceeding the available disk space due to anaconda bug
    1694065 - CVE-2019-0161 edk2: stack overflow in XHCI causing denial of service
    1702223 - Rebase RHV-H on RHEL 7.7
    1709829 - CVE-2019-10139 cockpit-ovirt: admin and appliance passwords saved in plain text variable file during HE deployment
    1718388 - CVE-2019-10160 python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
    1720156 - RHVH 4.3.4 version info is incorrect in plymouth and "/etc/os-release"
    1720160 - RHVH 4.3.4: Incorrect info in /etc/system-release-cpe
    1720310 - RHV-H post-installation scripts failing, due to existing tags
    1720434 - RHVH 7.7 brand is wrong in Anaconda GUI.
    1720435 - Failed to install RHVH 7.7
    1720436 - RHVH 7.7 should based on RHEL 7.7 server but not workstation.
    1724044 - Failed dependencies occur during install systemtap package.
    1726534 - dhclient fails to load libdns-export.so.1102 after upgrade if the user installed library is not persisted on the new layer
    1727007 - Update RHVH 7.7 branding with new Red Hat logo
    1727859 - Failed to boot after upgrading a host with a custom kernel
    1728998 - "nodectl info" displays error after RHVH installation
    1729023 - The error message is inappropriate when run `imgbase layout --init` on current layout
    
    6. Package List:
    
    Red Hat Virtualization 4 Hypervisor for RHEL 7:
    
    Source:
    redhat-virtualization-host-4.3.5-20190722.0.el7_7.src.rpm
    
    noarch:
    redhat-virtualization-host-image-update-4.3.5-20190722.0.el7_7.noarch.rpm
    
    RHEL 7-based RHEV-H for RHEV 4 (build requirements):
    
    Source:
    imgbased-1.1.9-0.1.el7ev.src.rpm
    ovirt-node-ng-4.3.5-0.20190717.0.el7ev.src.rpm
    redhat-release-virtualization-host-4.3.5-2.el7ev.src.rpm
    
    noarch:
    imgbased-1.1.9-0.1.el7ev.noarch.rpm
    ovirt-node-ng-nodectl-4.3.5-0.20190717.0.el7ev.noarch.rpm
    python-imgbased-1.1.9-0.1.el7ev.noarch.rpm
    python2-ovirt-node-ng-nodectl-4.3.5-0.20190717.0.el7ev.noarch.rpm
    redhat-virtualization-host-image-update-placeholder-4.3.5-2.el7ev.noarch.rpm
    
    x86_64:
    redhat-release-virtualization-host-4.3.5-2.el7ev.x86_64.rpm
    
    These packages are GPG signed by Red Hat for security.  Our key and
    details on how to verify the signature are available from
    https://access.redhat.com/security/team/key/
    
    7. References:
    
    https://access.redhat.com/security/cve/CVE-2018-16838
    https://access.redhat.com/security/cve/CVE-2018-16881
    https://access.redhat.com/security/cve/CVE-2019-0161
    https://access.redhat.com/security/cve/CVE-2019-1559
    https://access.redhat.com/security/cve/CVE-2019-10139
    https://access.redhat.com/security/cve/CVE-2019-10160
    https://access.redhat.com/security/updates/classification/#important
    
    8. Contact:
    
    The Red Hat security contact is . More contact
    details at https://access.redhat.com/security/team/contact/
    
    Copyright 2019 Red Hat, Inc.
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1
    
    iQIVAwUBXVFUTdzjgjWX9erEAQhvUg/+KuWuNcLr1x0BLbvWfJsuYMUckG6R0b7O
    LMfzW85i56jNIEkQjgAx7srTkzdBd65Fs5/s03jrk7G9A2FAmtpob2Wle9TSb7Mj
    L4n+1gomv8ecI7BB3FzmNT+TrE0jNL1oyYFp8Z7EBY2rRcTnssyDgZFQ4saCvIUQ
    omAYhp1bb8s+U37/jXZr1JpsM0+ctiys1Z3hXXxessbXM1F39MjHz4KCeOl3qi9l
    zpdA4dVFicBKEskV08K80id2GdWFDarynoA1ACCqSjU5FrPOGjzxcwxf2549RDGS
    oE/ME93EP4P6a/PTzVuMGSikzk593I2WTqP+lN+t71XxpZVK95zuYe5RWJuRDYbs
    uk70YXwaYLcuEghIRRA4kfu0m8FR4s3QAH+0VhbKzPWGZPDJOfJ0D7LDXIJ1KD5x
    f+j8eMfi71EZAROp/0xix8qPWdKlaI9aQ7xZxzDY9agw9DolOK/WG76f2vUROsGO
    lYF1nFPCbwewJVQKh7c7YRhvBkQ4L+SuENfuEN1jbrHPnqflndmwhf+1sZi1EyeT
    fbvsC4qNSRrgTzbc3cBop13LH+WM7XKdX/MJcrLRug+jfcB73pt7L72DT4AK3JjU
    2qry9rCZwCESairKCUaittFiNKBcNG9h13J563fXQGTJiW6Ji0t5fVpmnDXTv9nv
    9xyXEwKutJk=
    =xTlE
    -----END PGP SIGNATURE-----
    
    --
    RHSA-announce mailing list
    This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.redhat.com/mailman/listinfo/rhsa-announce
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"4","type":"x","order":"1","pct":57.14,"resources":[]},{"id":"88","title":"Should be more technical","votes":"2","type":"x","order":"2","pct":28.57,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"1","type":"x","order":"3","pct":14.29,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.