Synopsis

Moderate: rhevm security update

Type/Severity

Security Advisory: Moderate

Topic

Updated rhevm packages that fix one security issue are now available.

The Red Hat Security Response Team has rated this update as having Moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

Red Hat Enterprise Virtualization is a feature-rich server virtualization
management system that provides advanced capabilities for managing Red Hat
virtualization infrastructure for Servers and Desktops.

It was found that the oVirt storage back end did not wipe memory snapshots
when VMs were deleted, even if wipe-after-delete (WAD) was enabled for the
VM's disks. A remote attacker with credentials to create a new VM could use
this flaw to potentially access the contents of memory snapshots in an
uninitialized storage volume, possibly leading to the disclosure of
sensitive information. (CVE-2014-3559)

This issue was discovered by Idan Shaby and Allon Mureinik of Red Hat.

All rhevm users are advised to upgrade to these updated packages, which
correct this issue.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

Affected Products

• Red Hat Virtualization 3.4 x86_64

Fixes

• BZ - 1121925 - CVE-2014-3559 ovirt-engine-backend: memory snapshots not wiped when deleting a VM with wipe-after-delete (WAD) enabled for its disks

CVEs

• CVE-2014-3559

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat Virtualization 3.4

SRPM
rhevm-3.4.1-0.31.el6ev.src.rpm	SHA-256: 982af0dd0d3f8c1b78baec3dc94b175d23cd594be38a26c4ac96013fe2816ab3
x86_64
rhevm-3.4.1-0.31.el6ev.noarch.rpm	SHA-256: ae57892d03c9050eeceb34eb81699d72af1fb1dda3b01bd075e0e9e960bde2c1
rhevm-backend-3.4.1-0.31.el6ev.noarch.rpm	SHA-256: 5bb721b4bbceb174c7f6690b008efa8b8abf2a24142f07cebbb9b2c84c6734ec
rhevm-dbscripts-3.4.1-0.31.el6ev.noarch.rpm	SHA-256: c536baac0551f4fa790cf5e58bce4b213c4175815c8a44c90b753306d7f780a1
rhevm-lib-3.4.1-0.31.el6ev.noarch.rpm	SHA-256: 0604fe76d3590e2dad814e141eb6f53761090d7b246a7ca1dcc99dba7ce2f6fb
rhevm-restapi-3.4.1-0.31.el6ev.noarch.rpm	SHA-256: e7a3c214f78bf139a349761289e1e3a3dd3986bb84326a6ded4f548987b52445
rhevm-setup-3.4.1-0.31.el6ev.noarch.rpm	SHA-256: c0d90526370d6a793438a8887b88b77b59fc20b639ccfd552c607a0ad396f04a
rhevm-setup-base-3.4.1-0.31.el6ev.noarch.rpm	SHA-256: 7e5861610778b33edc82977fbb2b4c71264feeed479407a03eaa0051dede835e
rhevm-setup-plugin-allinone-3.4.1-0.31.el6ev.noarch.rpm	SHA-256: 6cfae990daec01a3db7d4164bb309690d0b9336bdbb243120a6abf2d5ce1550a
rhevm-setup-plugin-ovirt-engine-3.4.1-0.31.el6ev.noarch.rpm	SHA-256: 171df0c7015ce373cc39a67e73f8d011ad39ea2d564f79737c6b4278a224edc7
rhevm-setup-plugin-ovirt-engine-common-3.4.1-0.31.el6ev.noarch.rpm	SHA-256: 78adcdcae616a672db93592694aead5272d82ad7c7d169228402c650b5f0d37f
rhevm-setup-plugin-websocket-proxy-3.4.1-0.31.el6ev.noarch.rpm	SHA-256: 570e23297b495406d3fae2821bc01b4e31de06100953a6c846a83e262680df4c
rhevm-tools-3.4.1-0.31.el6ev.noarch.rpm	SHA-256: 11e4a5bd37fb18957a75648f4e02b6277d503aa6bb23d9617a402883aa47d629
rhevm-userportal-3.4.1-0.31.el6ev.noarch.rpm	SHA-256: 90a26c814cd310d2ddc0c64c3a86cbac2c6c76caf83c3433e4c9b393acebc6cd
rhevm-webadmin-portal-3.4.1-0.31.el6ev.noarch.rpm	SHA-256: 3c98c5fb0d23f00d90e37464011a7eb867892ea48c65daa927472266a7f978a8
rhevm-websocket-proxy-3.4.1-0.31.el6ev.noarch.rpm	SHA-256: 242611e269a5df567ed99c1b9e045e6e8d429e83cb54b48440374a441753c859