Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 534
Alerts This Week
Warning Icon 1 534

RedHat: RHSA-2022:8502-01 Moderate: ovirt-engine Security Fixes

red hat
Calendar Grey November 16, 2022
Dist Redhat Esm H88
The update RHSA-2022-8502 from Red Hat for ovirt-engine addresses several moderate security vulnerabilities while also introducing enhancements to its features.
Updated ovirt-engine packages that fix several bugs and add various enhancements are now available

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891

Summary

The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform that allows system administrators to view and manage virtual machines. The Manager provides a comprehensive range of features including search capabilities, resource management, live migrations, and virtual infrastructure provisioning.
Security Fix(es):
* follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor (CVE-2022-0155)
* ovirt-engine: RHVM admin password is logged unfiltered when using otopi-style (CVE-2022-2805)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* Ghost OVFs are written when using floating SD to migrate VMs between 2 RHV environments. (BZ#1705338)
* RHV engine is reporting a delete disk with wipe as completing successfully when it actually fails from a timeout. (BZ#1836318)
* [DR] Failover / Failback HA VM Fails to be started due to 'VM XXX is being imported' (BZ#1968433)
* Virtual Machine with lease fails to run on DR failover (BZ#1974535)
* Disk is missing after importing VM from Storage Domain that was detached from another DC. (BZ#1983567)
* Unable to switch RHV host into maintenance mode as there are image transfer in progress (BZ#2123141)
* not able to import disk in 4.5.2 (BZ#2134549)
Enhancement(s):
* [RFE] Show last events for user VMs (BZ#1886211)

Topics%20covered

Topics Covered

security advisory moderate security issue red hat bug fix management ovirt-engine

References

https://access.redhat.com/security/cve/CVE-2022-0155 https://access.redhat.com/security/cve/CVE-2022-2805 https://access.redhat.com/security/updates/classification/#moderate

Package List

RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4:
Source: ovirt-engine-4.5.3.2-1.el8ev.src.rpm ovirt-engine-dwh-4.5.7-1.el8ev.src.rpm ovirt-engine-ui-extensions-1.3.6-1.el8ev.src.rpm ovirt-web-ui-1.9.2-1.el8ev.src.rpm
noarch: ovirt-engine-4.5.3.2-1.el8ev.noarch.rpm ovirt-engine-backend-4.5.3.2-1.el8ev.noarch.rpm ovirt-engine-dbscripts-4.5.3.2-1.el8ev.noarch.rpm ovirt-engine-dwh-4.5.7-1.el8ev.noarch.rpm ovirt-engine-dwh-grafana-integration-setup-4.5.7-1.el8ev.noarch.rpm ovirt-engine-dwh-setup-4.5.7-1.el8ev.noarch.rpm ovirt-engine-health-check-bundler-4.5.3.2-1.el8ev.noarch.rpm ovirt-engine-restapi-4.5.3.2-1.el8ev.noarch.rpm ovirt-engine-setup-4.5.3.2-1.el8ev.noarch.rpm ovirt-engine-setup-base-4.5.3.2-1.el8ev.noarch.rpm ovirt-engine-setup-plugin-cinderlib-4.5.3.2-1.el8ev.noarch.rpm ovirt-engine-setup-plugin-imageio-4.5.3.2-1.el8ev.noarch.rpm ovirt-engine-setup-plugin-ovirt-engine-4.5.3.2-1.el8ev.noarch.rpm ovirt-engine-setup-plugin-ovirt-engine-common-4.5.3.2-1.el8ev.noarch.rpm ovirt-engine-setup-plugin-vmconsole-proxy-helper-4.5.3.2-1.el8ev.noarch.rpm ovirt-engine-setup-plugin-websocket-proxy-4.5.3.2-1.el8ev.noarch.rpm ovirt-engine-tools-4.5.3.2-1.el8ev.noarch.rpm ovirt-engine-tools-backup-4.5.3.2-1.el8ev.noarch.rpm

Read the Full Advisory


Advisory ID: RHSA-2022:8502-01
Product: Red Hat Virtualization
Advisory URL: https://access.redhat.com/errata/RHSA-2022:8502
Issue date: 2022-11-16

Topic

Updated ovirt-engine packages that fix several bugs and add variousenhancements are now available.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate security issue red hat bug fix management ovirt-engine

Relevant Releases Architectures

RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 - noarch

Bugs Fixed

1705338 - Ghost OVFs are written when using floating SD to migrate VMs between 2 RHV environments.

1836318 - RHV engine is reporting a delete disk with wipe as completing successfully when it actually fails from a timeout.

1886211 - [RFE] Show last events for user VMs

1968433 - [DR] Failover / Failback HA VM Fails to be started due to 'VM XXX is being imported'

1974535 - Virtual Machine with lease fails to run on DR failover

1983567 - Disk is missing after importing VM from Storage Domain that was detached from another DC.

2044556 - CVE-2022-0155 follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor

2079545 - CVE-2022-2805 ovirt-engine: RHVM admin password is logged unfiltered when using otopi-style

2118672 - Use rpm instead of auto in package_facts ansible module to prevent mistakes of determining the correct package manager inside package_facts module

2123141 - Unable to switch RHV host into maintenance mode as there are image transfer in progress

2127836 - Create template dialog is not closed when clicking in OK and the template is not created

2134549 - not able to import disk in 4.5.2

2137207 - The RemoveDisk job finishes before the disk was removed from the DB

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.