Important: RHV RHEL Host (ovirt-host) [ovirt-4.5.2] security update

Related Vulnerabilities: CVE-2022-31129  

Synopsis

Important: RHV RHEL Host (ovirt-host) [ovirt-4.5.2] security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Updated host packages that fix several bugs and add various enhancements are now available.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The ovirt-host package consolidates host package requirements into a single meta package.

Security Fix(es):

  • moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • The hosted-engine-ha binaries have been moved from /usr/share to /usr/libexec. As a result, the hosted-engine --clean-metadata command fails. With this release, you must use the new path for the command to succeed: /usr/libexec/ovirt-hosted-engine-ha/ovirt-ha-agent (BZ#2105781)
  • A new warning has been added to the vdsm-tool to protect users from using the unsupported user_friendly_names multipath configuration. The following is an example of the output:

$ vdsm-tool is-configured --module multipath
WARNING: Invalid configuration: 'user_friendly_names' is enabled in multipath configuration:
section1 {
key1 value1
user_friendly_names yes
key2 value2
}
section2 {
user_friendly_names yes
}
This configuration is not supported and may lead to storage domain corruption. (BZ#1793207)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891

Affected Products

  • Red Hat Virtualization 4 for RHEL 8 x86_64
  • Red Hat Virtualization Host 4 for RHEL 8 x86_64
  • Red Hat Virtualization for IBM Power LE 4 for RHEL 8 ppc64le

Fixes

  • BZ - 1793207 - [RFE] Notify if multipath User Friendly Names are used
  • BZ - 2105075 - CVE-2022-31129 moment: inefficient parsing algorithm resulting in DoS
  • BZ - 2105781 - hosted-engine --clean-metadata fails because ovirt-ha-agent has changed location
  • BZ - 2117558 - hosted-engine deploy failed since "Failed to configure OVN controller"