Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

RedHat RHSA-2020-3247-01 Important: RHV Manager Security Update

red hat
Calendar Grey August 4, 2020
Dist Redhat Esm H88
The RHV Manager (ovirt-engine) 4.4 security patch is crucial as it resolves critical vulnerabilities like XSS and DoS, enhancing system integrity and availability.
Updated ovirt-engine packages that fix several bugs and add various enhancements are now available

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/2974891

Summary

The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform that allows system administrators to view and manage virtual machines. The Manager provides a comprehensive range of features including search capabilities, resource management, live migrations, and virtual infrastructure provisioning.
The Manager is a JBoss Application Server application that provides several interfaces through which the virtual environment can be accessed and interacted with, including an Administration Portal, a VM Portal, and a Representational State Transfer (REST) Application Programming Interface (API).
A list of bugs fixed in this update is available in the Technical Notes book:
ml-single/technical_notes
Security Fix(es):
* apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default (CVE-2019-10086)
* libquartz: XXE attacks via job description (CVE-2019-13990)
* novnc: XSS vulnerability via the messages propagated to the status field (CVE-2017-18635)
* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)
* nimbus-jose-jwt: Uncaught exceptions while parsing a JWT (CVE-2019-17195)
* ovirt-engine: response_type parameter allows reflected XSS (CVE-2019-19336)
* nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)
* ovirt-engine: Redirect to arbitrary URL allows for phishing (CVE-2020-10775)
* Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* jQuery: passing HTML containing

Topics%20covered

Topics Covered

security advisory bug fix important xss dos red hat virtualization redirect attack

References

https://access.redhat.com/security/cve/CVE-2017-18635 https://access.redhat.com/security/cve/CVE-2019-8331 https://access.redhat.com/security/cve/CVE-2019-10086 https://access.redhat.com/security/cve/CVE-2019-13990 https://access.redhat.com/security/cve/CVE-2019-17195 https://access.redhat.com/security/cve/CVE-2019-19336 https://access.redhat.com/security/cve/CVE-2020-7598 https://access.redhat.com/security/cve/CVE-2020-10775 https://access.redhat.com/security/cve/CVE-2020-11022 https://access.redhat.com/security/cve/CVE-2020-11023 https://access.redhat.com/security/updates/classification/#important https://docs.redhat.com/en/documentation/red_hat_virtualization/4.3/html-single/technical_notes/index

Package List

RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4:
Source: ansible-runner-1.4.5-1.el8ar.src.rpm ansible-runner-service-1.0.2-1.el8ev.src.rpm apache-commons-collections4-4.4-1.el8ev.src.rpm apache-commons-compress-1.18-1.el8ev.src.rpm apache-commons-configuration-1.10-1.el8ev.src.rpm apache-commons-jexl-2.1.1-1.el8ev.src.rpm apache-commons-jxpath-1.3-29.el8ev.src.rpm apache-commons-vfs-2.4.1-1.el8ev.src.rpm apache-sshd-2.5.1-1.el8ev.src.rpm ebay-cors-filter-1.0.1-4.el8ev.src.rpm ed25519-java-0.3.0-1.el8ev.src.rpm engine-db-query-1.6.1-1.el8ev.src.rpm java-client-kubevirt-0.5.0-1.el8ev.src.rpm log4j12-1.2.17-22.el8ev.src.rpm m2crypto-0.35.2-5.el8ev.src.rpm makeself-2.4.0-4.el8ev.src.rpm novnc-1.1.0-1.el8ost.src.rpm openstack-java-sdk-3.2.9-1.el8ev.src.rpm ovirt-cockpit-sso-0.1.4-1.el8ev.src.rpm ovirt-engine-4.4.1.8-0.7.el8ev.src.rpm ovirt-engine-api-explorer-0.0.6-1.el8ev.src.rpm ovirt-engine-dwh-4.4.1.2-1.el8ev.src.rpm ovirt-engine-extension-aaa-jdbc-1.2.0-1.el8ev.src.rpm ovirt-engine-extension-aaa-ldap-1.4.0-1.el8ev.src.rpm ovirt-engine-extension-aaa-misc-1.1.0-1.el8ev.src.rpm ovirt-engine-extension-logger-log4j-1.1.0-1.el8ev.src.rpm ovirt-engine-extensions-api-1.0.1-1.el8ev.src.rpm ovirt-engine-metrics-1.4.1.1-1.el8ev.src.rpm

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2020:3247-01
Product: Red Hat Virtualization
Advisory URL: https://access.redhat.com/errata/RHSA-2020:3247
Issue date: 2020-08-04

Topic

Updated ovirt-engine packages that fix several bugs and add variousenhancements are now available.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory bug fix important xss dos red hat virtualization redirect attack

Relevant Releases Architectures

RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 - noarch, x86_64

Bugs Fixed

1080097 - [RFE] Allow editing disks details in the Disks tab

1325468 - [RFE] Autostart of VMs that are down (with Engine assistance - Engine has to be up)

1358501 - [RFE] multihost network change - notify when done

1427717 - [RFE] Create and/or select affinity group upon VM creation.

1475774 - RHV-M requesting four GetDeviceListVDSCommand when editing storage domain

1507438 - not able to deploy new rhvh host when "/tmp" is mounted with "noexec" option

1523835 - Hosted-Engine: memory hotplug does not work for engine vm

1527843 - [Tracker] Q35 chipset support (with seabios)

1529042 - [RFE] Changing of Cluster CPU Type does not trigger config update notification

1535796 - Undeployment of HE is not graceful

1546838 - [RFE] Refuse to deploy on localhost.localdomain

1547937 - [RFE] Live Storage Migration progress bar.

1585986 - [HE] When lowering the cluster compatibility, we need to force update the HE storage OVF store to ensure it can start up (migration will not work).

1593800 - [RFE] forbid new mac pools with overlapping ranges

1596178 - inconsistent display between automatic and manual Pool Type

1600059 - [RFE] Add by default a storage lease to HA VMs

1610212 - After updating to RHV 4.1 while trying to edit the disk, getting error "Cannot edit Virtual Disk. Cannot edit Virtual Disk. Disk extension combined with disk compat version update isn't supported. Please perform the updates separately."

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here