Hash: SHA256

                   Red Hat Security Advisory

Synopsis:          Moderate: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] 0-day security, bug fix, enhance
Advisory ID:       RHSA-2021:1186-01
Product:           Red Hat Virtualization
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:1186
Issue date:        2021-04-14
CVE Names:         CVE-2019-20921 CVE-2020-28458 

1. Summary:

An update for org.ovirt.engine-root, ovirt-engine-ui-extensions, and
ovirt-web-ui is now available for Red Hat Virtualization Engine 4.4.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 - noarch

3. Description:

The ovirt-engine package provides the manager for virtualization
This manager enables admins to define hosts and networks, as well as to add
storage, create VMs and manage user permissions.

Bug Fix(es):
* Previously, saving user preferences in the Red Hat Virtualization Manager
required the MANIPULATE_USERS permission level. As a result, user
preferences were not saved on the server.
In this release, the required permission level for saving user preferences
was changed to EDIT_PROFILE, which is the permission level assigned by
default to all users. As a result, saving user preferences works as
expected. (BZ#1920539)

A list of bugs fixed in this update is available in the Technical Notes


Security Fix(es):

* nodejs-bootstrap-select: not escaping title values on