Synopsis
Important: Red Hat Virtualization security update
Type/Severity
Security Advisory: Important
Topic
An update for redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.
The following packages have been upgraded to a later upstream version: imgbased (1.1.9), ovirt-node-ng (4.3.5), redhat-release-virtualization-host (4.3.5), redhat-virtualization-host (4.3.5). (BZ#1669357, BZ#1669365, BZ#1684986, BZ#1711193, BZ#1717250, BZ#1726917)
Security Fix(es):
- python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc (CVE-2019-10160)
- rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is enabled (CVE-2018-16881)
- edk2: stack overflow in XHCI causing denial of service (CVE-2019-0161)
- openssl: 0-byte record padding oracle (CVE-2019-1559)
- cockpit-ovirt: admin and appliance passwords saved in plain text variable file during HE deployment (CVE-2019-10139)
- sssd: improper implementation of GPOs due to too restrictive permissions (CVE-2018-16838)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Solution
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/2974891
Affected Products
-
Red Hat Virtualization 4 for RHEL 7 x86_64
-
Red Hat Virtualization Host 4 x86_64
Fixes
- BZ - 1640820 - CVE-2018-16838 sssd: improper implementation of GPOs due to too restrictive permissions
- BZ - 1658366 - CVE-2018-16881 rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is enabled
- BZ - 1683804 - CVE-2019-1559 openssl: 0-byte record padding oracle
- BZ - 1687920 - RHVH fails to reinstall if required size is exceeding the available disk space due to anaconda bug
- BZ - 1694065 - CVE-2019-0161 edk2: stack overflow in XHCI causing denial of service
- BZ - 1702223 - Rebase RHV-H on RHEL 7.7
- BZ - 1709829 - CVE-2019-10139 cockpit-ovirt: admin and appliance passwords saved in plain text variable file during HE deployment
- BZ - 1718388 - CVE-2019-10160 python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
- BZ - 1720156 - RHVH 4.3.4 version info is incorrect in plymouth and "/etc/os-release"
- BZ - 1720160 - RHVH 4.3.4: Incorrect info in /etc/system-release-cpe
- BZ - 1720310 - RHV-H post-installation scripts failing, due to existing tags
- BZ - 1720434 - RHVH 7.7 brand is wrong in Anaconda GUI.
- BZ - 1720435 - Failed to install RHVH 7.7
- BZ - 1720436 - RHVH 7.7 should based on RHEL 7.7 server but not workstation.
- BZ - 1724044 - Failed dependencies occur during install systemtap package.
- BZ - 1726534 - dhclient fails to load libdns-export.so.1102 after upgrade if the user installed library is not persisted on the new layer
- BZ - 1727007 - Update RHVH 7.7 branding with new Red Hat logo
- BZ - 1727859 - Failed to boot after upgrading a host with a custom kernel
- BZ - 1728998 - "nodectl info" displays error after RHVH installation
- BZ - 1729023 - The error message is inappropriate when run `imgbase layout --init` on current layout
CVEs
References
Vulmon