-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Important: redhat-release-virtualization-host and redhat-virtualization-host security update
Advisory ID:       RHSA-2020:4115-01
Product:           Red Hat Virtualization
Advisory URL:      https://access.redhat.com/errata/RHSA-2020:4115
Issue date:        2020-09-30
CVE Names:         CVE-2020-10713 CVE-2020-14364 
====================================================================
1. Summary:

An update for redhat-release-virtualization-host and
redhat-virtualization-host is now available for Red Hat Virtualization 4
for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

RHEL 7-based RHEV-H for RHEV 4 (build requirements) - noarch, x86_64
Red Hat Virtualization 4 Hypervisor for RHEL 7 - noarch

3. Description:

The redhat-virtualization-host packages provide the Red Hat Virtualization
Host. These packages include redhat-release-virtualization-host,
ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are
installed using a special build of Red Hat Enterprise Linux with only the
packages required to host virtual machines. RHVH features a Cockpit user
interface for monitoring the host's resources and performing administrative
tasks. 

The ovirt-node-ng packages provide the Red Hat Virtualization Host. These
packages include redhat-release-virtualization-host, ovirt-node, and
rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a
special build of Red Hat Enterprise Linux with only the packages required
to host virtual machines. RHVH features a Cockpit user interface for
monitoring the host's resources and performing administrative tasks.

The following packages have been upgraded to a later upstream version:
redhat-release-virtualization-host (4.3.11), redhat-virtualization-host
(4.3.11). (BZ#1868307, BZ#1878044)

Security Fix(es):

* grub2: Crafted grub.cfg file can lead to arbitrary code execution during
boot process (CVE-2020-10713)

* QEMU: usb: out-of-bounds r/w access issue while processing usb packets
(CVE-2020-14364)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/2974891

5. Bugs fixed (https://bugzilla.redhat.com/):

1825243 - CVE-2020-10713 grub2: Crafted grub.cfg file can lead to arbitrary code execution during boot process
1845590 - Rebase redhat-virtualization-host on RHV 4.3.111868307 - Rebase RHV-H 4.3.11 on Ansible 2.9.13
1869201 - CVE-2020-14364 QEMU: usb: out-of-bounds r/w access issue while processing usb packets

6. Package List:

Red Hat Virtualization 4 Hypervisor for RHEL 7:

Source:
redhat-virtualization-host-4.3.11-20200922.0.el7_9.src.rpm

noarch:
redhat-virtualization-host-image-update-4.3.11-20200922.0.el7_9.noarch.rpm

RHEL 7-based RHEV-H for RHEV 4 (build requirements):

Source:
redhat-release-virtualization-host-4.3.11-1.el7ev.src.rpm
redhat-virtualization-host-4.3.11-20200922.0.el7_9.src.rpm

noarch:
redhat-virtualization-host-image-update-4.3.11-20200922.0.el7_9.noarch.rpm
redhat-virtualization-host-image-update-placeholder-4.3.11-1.el7ev.noarch.rpm

x86_64:
redhat-release-virtualization-host-4.3.11-1.el7ev.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-10713
https://access.redhat.com/security/cve/CVE-2020-14364
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/grub2bootloader

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBX3RaPtzjgjWX9erEAQgpEA/+N7+5QD0Aceukcq+D9XIK4Bf3yvMh84JD
CVbYyomy5DV/qECR/G0PO8IdPzHPULW1RQTp1tbF9wmuB1NDNpJHDp+W4/LV2Uh0
dcXkcSgHZWQIZG8pDFc6jS3C1pulnZRYSE53r/AEbWleoCYhr3+a+5xITkLvB2fq
06dxQlOIJCKbEOOzNL5koiy/6clRVrI37O8BMApQylYguy8ExhKQSJlNq3CupBkV
fHWe9IhagOXxu83XdLKHxHnDltoFNZqQb2/tuGL0hbhUn7toHhOjSqnKS8HBCESi
qXpvRpcYsjlW6vGhr6SzglvYNXrHhO31xx8KP9H7BFBjTWA042uZSro/rCDUzT7G
wh0eW8uSzLR9teEMhWygmMrp1B1EKse4+yPnQK2vHKnUCTZ2Oz8fJq7Ul45wULKy
/it+yXqyeD7XH5vs7vxX+CAlPXTROPFqaJSn2FsPbN7BSyp55lrNTQjap/rdCVaZ
EOZcFnEQB3Gt9gwgJ7tbBYtGFhLT8IjLY2n5HxDy0FImUQmxBKyoNyaJYy0/q2dk
Lfob+ywSsGlQs/3i7PHXg6gqgACDTDYc435x+DfB+Mc2jN6c8uZ0xX5j+suPuaN+
j79iwO2lHb96fleATb51Upxgeh5+TqjClLSEP4+/wO3hQw1ECA4zWXQc5e3yJ+Ab
+Dwywr7psOM=wvuT
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2020-4115:01 Important: redhat-release-virtualization-host and

An update for redhat-release-virtualization-host and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Summary

The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.
The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.
The following packages have been upgraded to a later upstream version: redhat-release-virtualization-host (4.3.11), redhat-virtualization-host (4.3.11). (BZ#1868307, BZ#1878044)
Security Fix(es):
* grub2: Crafted grub.cfg file can lead to arbitrary code execution during boot process (CVE-2020-10713)
* QEMU: usb: out-of-bounds r/w access issue while processing usb packets (CVE-2020-14364)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.



Summary


Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/2974891

References

https://access.redhat.com/security/cve/CVE-2020-10713 https://access.redhat.com/security/cve/CVE-2020-14364 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/grub2bootloader

Package List

Red Hat Virtualization 4 Hypervisor for RHEL 7:
Source: redhat-virtualization-host-4.3.11-20200922.0.el7_9.src.rpm
noarch: redhat-virtualization-host-image-update-4.3.11-20200922.0.el7_9.noarch.rpm
RHEL 7-based RHEV-H for RHEV 4 (build requirements):
Source: redhat-release-virtualization-host-4.3.11-1.el7ev.src.rpm redhat-virtualization-host-4.3.11-20200922.0.el7_9.src.rpm
noarch: redhat-virtualization-host-image-update-4.3.11-20200922.0.el7_9.noarch.rpm redhat-virtualization-host-image-update-placeholder-4.3.11-1.el7ev.noarch.rpm
x86_64: redhat-release-virtualization-host-4.3.11-1.el7ev.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
Advisory ID: RHSA-2020:4115-01
Product: Red Hat Virtualization
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4115
Issued Date: : 2020-09-30
CVE Names: CVE-2020-10713 CVE-2020-14364

Topic

An update for redhat-release-virtualization-host andredhat-virtualization-host is now available for Red Hat Virtualization 4for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures

RHEL 7-based RHEV-H for RHEV 4 (build requirements) - noarch, x86_64

Red Hat Virtualization 4 Hypervisor for RHEL 7 - noarch


Bugs Fixed

1825243 - CVE-2020-10713 grub2: Crafted grub.cfg file can lead to arbitrary code execution during boot process

1845590 - Rebase redhat-virtualization-host on RHV 4.3.111868307 - Rebase RHV-H 4.3.11 on Ansible 2.9.13

1869201 - CVE-2020-14364 QEMU: usb: out-of-bounds r/w access issue while processing usb packets


Related News