Stay Secure with the Latest Linux Advisories

security advisorysecurity issueupdate

RedHat: RHSA-2020-4172-01 Important: Red Hat Virtualization Security Update

An update for cockpit-ovirt, imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Virtualization security, bug fix, and enhancement update Advisory ID: RHSA-2020:4172-01 Product: Red Hat Virtualization Advisory URL: https://access.redhat.com/errata/RHSA-2020:4172 Issue date: 2020-10-05 CVE Names: CVE-2020-10713 CVE-2020-14364 ==================================================================== 1. Summary: An update for cockpit-ovirt, imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: RHEL 8-based RHEV-H for RHEV 4 (build requirements) - noarch, x86_64 Red Hat Virtualization 4 Hypervisor for RHEL 8 - noarch Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts - noarch 3. Description: The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. The ovirt-node-ng packages provide the Red Hat Virtualization Host.These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. The following packages have been upgraded to a later upstream version: cockpit-ovirt (0.14.11), imgbased (1.2.12), redhat-release-virtualization-host (4.4.2), redhat-virtualization-host (4.4.2). (BZ#1875362, BZ#1878045) Security Fix(es): * grub2: Crafted grub.cfg file can lead to arbitrary code execution during boot process (CVE-2020-10713) * QEMU: usb: out-of-bounds r/w access issue while processing usb packets (CVE-2020-14364) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891 5. Bugs fixed (https://bugzilla.redhat.com/): 1805589 - grub2-mkconfig produces incorrect config if host installed over iSCSI 1825243 - CVE-2020-10713 grub2: Crafted grub.cfg file can lead to arbitrary code execution during boot process 1847547 - SSH connection disabled during ISO installation 1852721 - Installation of node will not quit when mountpoint has existing domain (VMs) 1859876 - imgbase check failed after register to engine 1868312 - Rebase RHV-H 4.4.2 on Ansible 2.9.12 1869201 - CVE-2020-14364 QEMU: usb: out-of-bounds r/w access issue while processing usb packets 1873049 - Require tested ansible-2.9.13 for ovirt-hosted-engine-setup in RHV Manager 4.4.2 1875362 - Upgrade cockpit-ovirt to 0.14.11 6. Package List: Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts: Source: cockpit-ovirt-0.14.11-1.el8ev.src.rpm noarch: cockpit-ovirt-dashboard-0.14.11-1.el8ev.noarch.rpm RedHat Virtualization 4 Hypervisor for RHEL 8: Source: redhat-virtualization-host-4.4.2-20200930.0.el8_2.src.rpm noarch: redhat-virtualization-host-image-update-4.4.2-20200930.0.el8_2.noarch.rpm RHEL 8-based RHEV-H for RHEV 4 (build requirements): Source: imgbased-1.2.12-0.1.el8ev.src.rpm redhat-release-virtualization-host-4.4.2-1.el8ev.src.rpm noarch: imgbased-1.2.12-0.1.el8ev.noarch.rpm python3-imgbased-1.2.12-0.1.el8ev.noarch.rpm redhat-virtualization-host-image-update-placeholder-4.4.2-1.el8ev.noarch.rpm x86_64: redhat-release-virtualization-host-4.4.2-1.el8ev.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2020-10713 https://access.redhat.com/security/cve/CVE-2020-14364 https://access.redhat.com/security/updates/classification#important https://access.redhat.com/security/vulnerabilities/grub2bootloader 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBX3sbdtzjgjWX9erEAQhKZQ//Qa9rfoZykXHZskSCS3iXT7uBVWxlaJpa uJhsB/CKcjBINJCKflXk1ogzWgYw72vtr9wCle/6lmtEhfDfLEbExh7nGOZp4F7l G/t/e5Mw7iN5WN/dMGJI2Z3Za9o+8GnQNuOjnXrGq7DlRTuBUpUZyAl6ciE3asA1 HHWJZOWBCaXnu9GVDQjKSiUXQCMy7MDEfAGR9r3FG4vJIG8tQisPV6btJ/54M/pM WbGijRJUBkJExz/0PHAJ7neEPnlpvLvTUD4khKSL1X+UKidyt1qFJc5JQ1Sy5ZXI IQAJEJiKucfm2SMkMLcFFob3cwwQwqpIsSeaK+O0GLEO8NBLe0JDPMPwhjN0KbKy nSGV5FU95PgBbcYFB7h8fMaZwiG+yxm4qMThJcAorNC0f7vuwumYs36Xd0Lk5qmT prPxRzPxhGW+5MYOTac69bMT3fU59Yj9ul6OKA9Z0FM5pYgC41Vn/ArpDsk4cqFG JtvAVw3nlYO+YIqQ8oSg6g3ti4U1Uklo27EFDHcbSx2RgtM664jVBWziR1+Ye8fa gPTixKWzcCcRaY5qwwYuRRdhATSlDX8GfCXzZH/7G+hMkJAmaFqpOHUQwyo48rDc mHqrCfGtcRCSLHaaGcLrCc7cB/O0yO4a7wzjjFW5FkhYk0Q3rFirn7Vx/k72DFrU oFe/ZD4zVVA=MRJ+ -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. .Implementing security updates and addressing vulnerabilities in Red Hat Virtualization 4 on RHEL 8, essential guidelines must be followed.. Red Hat Virtualization, security patch, management host, bug fix. . Severity: Important. LinuxSecurity.com Team

Oct 05, 2020 •Important Red Hat