RedHat: RHSA-2019-3464:01 Low: virt-manager security, bug fix,

    Date05 Nov 2019
    CategoryRed Hat
    23
    Posted ByLinuxSecurity Advisories
    An update for virt-manager is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256
    
    =====================================================================
                       Red Hat Security Advisory
    
    Synopsis:          Low: virt-manager security, bug fix, and enhancement update
    Advisory ID:       RHSA-2019:3464-01
    Product:           Red Hat Enterprise Linux
    Advisory URL:      https://access.redhat.com/errata/RHSA-2019:3464
    Issue date:        2019-11-05
    CVE Names:         CVE-2019-10183 
    =====================================================================
    
    1. Summary:
    
    An update for virt-manager is now available for Red Hat Enterprise Linux 8.
    
    Red Hat Product Security has rated this update as having a security impact
    of Low. A Common Vulnerability Scoring System (CVSS) base score, which
    gives a detailed severity rating, is available for each vulnerability from
    the CVE link(s) in the References section.
    
    2. Relevant releases/architectures:
    
    Red Hat Enterprise Linux AppStream (v. 8) - noarch
    
    3. Description:
    
    Virtual Machine Manager (virt-manager) is a graphical tool for
    administering virtual machines for KVM, Xen, and Linux Containers (LXC).
    The virt-manager utility uses the libvirt API and can start, stop, add or
    remove virtualized devices, connect to a graphical or serial console, and
    view resource usage statistics for existing virtualized guests on local or
    remote machines. 
    
    The following packages have been upgraded to a later upstream version:
    virt-manager (2.2.1). (BZ#1727881)
    
    Security Fix(es):
    
    * virt-install: unattended option leaks password via command line argument
    (CVE-2019-10183)
    
    For more details about the security issue(s), including the impact, a CVSS
    score, acknowledgments, and other related information, refer to the CVE
    page(s) listed in the References section.
    
    Additional Changes:
    
    For detailed information on changes in this release, see the Red Hat
    Enterprise Linux 8.1 Release Notes linked from the References section.
    
    4. Solution:
    
    For details on how to apply this update, which includes the changes
    described in this advisory, refer to:
    
    https://access.redhat.com/articles/11258
    
    5. Bugs fixed (https://bugzilla.redhat.com/):
    
    1599139 - RFE: Support genid in virt-manager
    1659354 - video devices should be removeable when vm has more than one video devices
    1660123 - No spice channel is added for Windows guests
    1660467 - Can create a new vm with the MAC address in use on rhel8.0
    1661867 - Cannot add a new virtual network: SR-IOV VF pool on rhel8
    1666597 - Cannot enable or disable system tray icon
    1667025 - Cannot modify guest's name on uefi firmware when creating new vm on rhel 8
    1671599 - 'Allocation' under Storage volume quota for qcow2 format volume is redundant
    1679018 - RuntimeError: Path does not exist: /var/lib/libvirt/qemu/nvram/test_VARS.fd
    1683609 - [RFE] virt-install should add input devices when graphics are enabled
    1690685 - Fail to force clone an empty cdrom device
    1690687 - Fail to update graphic listen type by virt-xml
    1692489 - virt-install fails with "Storage pool not found: no storage pool with matching name 'default'"
    1700354 - warn if use of secboot UEFI will overwrite machine to q35
    1707379 - virt-install with --sysinfo type=random-string silently defaults to smbios
    1709857 - RFE - Ability to add IBPB feature policy to mitigate Spectre v2 for VM guests
    1714304 - virt-install --os-variant rhel7 causes stack trace
    1718065 - Drop virt-convert from rhel8
    1722820 - missing gtksourceview3 dependency
    1724287 - Using --wait 0  option in virt-install  will return with exit code 1
    1726232 - CVE-2019-10183 virt-install: unattended option leaks password via command line argument
    1727811 - WARNING  Changing machine type from '%s' to 'q35' which is required for UEFI secure boot
    1727881 - Rebase virt-manager to current upstream release
    1741846 - virt-install man page typo issue for "--launchSecurity" option
    
    6. Package List:
    
    Red Hat Enterprise Linux AppStream (v. 8):
    
    Source:
    virt-manager-2.2.1-2.el8.src.rpm
    
    noarch:
    virt-install-2.2.1-2.el8.noarch.rpm
    virt-manager-2.2.1-2.el8.noarch.rpm
    virt-manager-common-2.2.1-2.el8.noarch.rpm
    
    These packages are GPG signed by Red Hat for security.  Our key and
    details on how to verify the signature are available from
    https://access.redhat.com/security/team/key/
    
    7. References:
    
    https://access.redhat.com/security/cve/CVE-2019-10183
    https://access.redhat.com/security/updates/classification/#low
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/
    
    8. Contact:
    
    The Red Hat security contact is . More contact
    details at https://access.redhat.com/security/team/contact/
    
    Copyright 2019 Red Hat, Inc.
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1
    
    iQIUAwUBXcHprdzjgjWX9erEAQgtcA/4zzBlgY4u903iiXL1kzzlmZbCWdiH3OXy
    SGwW90MIjBTrToaUQ1Ix1y9cdDYqaUM+tlYwNy8tC7El/nULW+Le2M5BNxc9iAce
    fIF6Sqlut+nZkFxP5q5kxndZMrPzqLZAGO9sP1p+Ma6P4IxHmMB7+z/0qRwbQHD+
    Iz2M+mxm3EunPZYF330zoYAj2udBDLPNKV4c2JVauz1DzOkfihdUXyjr/k9/Shee
    VUoIuBDk7Tk3WWlRdp/iRk9osQYwERP068lr19hfVSA0npHTM08WgV/4N097/1Fb
    fFMYvbQD+et2yO8tdcqoScBjC/c2usVw7iEJts9xpZM/TD3CJ0wBBEoNh7b/S72o
    fEqGBsmt5R/AT3r85JeWYwnFHCyQlL/e8CIigMufSZKdCYku51LDn2s8AixtSC3Y
    JB8URmw40omu0ETz2W/nhIOpUh8tq1hEIjD8RxwmS5KKz6WKUPmCkQbo5W0U54vA
    ecRtXLYGr9+zJvO1XLBT4HDZgUtQa/zA5ZOPB5sK9SKiTgP/dPgSc/FmgWGnqjNs
    QEgxFwOThuiO6UoQamOAJ6ZzGtjVgZNg4ppMNXjmiz/qfujF3yG9pnkGPhdcPl78
    rYhvjgMmsjzM5Op1hsN2QV3bJ6P4xmEwdSsehEbc4tPtB6ag3cUmK7VxJCjTiN2i
    FRy1Z1FmdQ==
    =5uBQ
    -----END PGP SIGNATURE-----
    
    --
    RHSA-announce mailing list
    This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.redhat.com/mailman/listinfo/rhsa-announce
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"64","type":"x","order":"1","pct":57.14,"resources":[]},{"id":"88","title":"Should be more technical","votes":"15","type":"x","order":"2","pct":13.39,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"33","type":"x","order":"3","pct":29.46,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.