Synopsis

Moderate: Red Hat Enterprise Virtualization Manager 3.4.2 update

Type/Severity

Security Advisory: Moderate

Topic

Red Hat Enterprise Virtualization Manager 3.4.2 is now available.

Red Hat Product Security has rated this update as having Moderate security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

Description

Red Hat Enterprise Virtualization Manager is a visual tool for centrally
managing collections of virtual servers running Red Hat Enterprise Linux
and Microsoft Windows. This package also includes the Red Hat Enterprise
Virtualization Manager API, a set of scriptable commands that give
administrators the ability to perform queries and operations on Red Hat
Enterprise Virtualization Manager.

The Manager is a JBoss Application Server application that provides several
interfaces through which the virtual environment can be accessed and
interacted with, including an Administration Portal, a User Portal, and a
Representational State Transfer (REST) Application Programming Interface
(API).

It was discovered that, when loading XML/RSDL documents, the oVirt Engine
back end module used an insecure DocumentBuilderFactory. A remote,
authenticated attacker could use this flaw to read files accessible to the
user running the ovirt-engine server, and potentially perform other more
advanced XML External Entity (XXE) attacks. (CVE-2014-3573)

This issue was discovered by Arun Babu Neelicattu of Red Hat Product
Security.

These updated Red Hat Enterprise Virtualization Manager packages also
include numerous bug fixes and various enhancements. Space precludes
documenting all of these changes in this advisory. Users are directed to
the Red Hat Enterprise Virtualization 3.4 Technical Notes, linked to in the
References, for information on the most significant of these changes.

All Red Hat Enterprise Virtualization Manager users are advised to upgrade
to these updated packages, which resolve these issues and add these
enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

Affected Products

• Red Hat Virtualization 3.4 x86_64

Fixes

• BZ - 1114877 - CPU hot plug "tool tip", in VM edit dialogue, is not clear.
• BZ - 1122446 - Violating hard constraint positive Affinity rule can prevent fixing the violated rule forever
• BZ - 1125262 - Cannot add AD group to a new VM from the user portal
• BZ - 1125373 - ovirt-engine currently sets the disk device to "lun" for all virtio-scsi direct LUN connections and disables read-only for these devices
• BZ - 1125795 - CVE-2014-3573 oVirt Engine: XML eXternal Entity (XXE) flaw in backend module
• BZ - 1126221 - [engine-backend] [iSCSI multipath] It's possible to remove a network from the setup even though it participates in an iSCSI multipath bond
• BZ - 1126428 - [engine-backend] [iSCSI multipath] No indication that updating an iSCSI multipath bond doesn't trigger any operation from vdsm side
• BZ - 1126797 - Odd vCPU topology dropped by libvirt
• BZ - 1127007 - [engine-backend] [iscsi multipath] After networks replacement in an iSCSI multipath bond had failed, the bond's networks aren't being updated back
• BZ - 1131294 - Can't change a vm disk's storage domain from a file domain to a block domain when creating a template from a vm
• BZ - 1131295 - Could not import a VM from export domain with raw sparse disks to a block storage domain

CVEs

• CVE-2014-3573

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.4/html-single/Technical_Notes/index.html

Red Hat Virtualization 3.4

SRPM
rhevm-3.4.2-0.2.el6ev.src.rpm	SHA-256: 93111353ad371d3141eb039529e5255321fef193d0fe9702d2c4cb68cf65d492
x86_64
rhevm-3.4.2-0.2.el6ev.noarch.rpm	SHA-256: 22a78738ab191c7b7eb26d4ac12ce376ffbf4e7be6db33d48f15244687228422
rhevm-backend-3.4.2-0.2.el6ev.noarch.rpm	SHA-256: cc533f1fc6abb5b0dbccb4f670b3a838fc72a5fa12eb5671871fcf83f19b14fa
rhevm-dbscripts-3.4.2-0.2.el6ev.noarch.rpm	SHA-256: b0a08db2fbc99fb7ac778d6ca7804ce31bd670c3296156be907764cb17f68fd1
rhevm-lib-3.4.2-0.2.el6ev.noarch.rpm	SHA-256: 4f9d181b08420f7e56a48f10e76ff28e097e6848355c1452685b51b8ba8c42a9
rhevm-restapi-3.4.2-0.2.el6ev.noarch.rpm	SHA-256: c6fb8ae9819954c183c49694b6afc59678bd2425e8b0ff5a6f2d1049666034b1
rhevm-setup-3.4.2-0.2.el6ev.noarch.rpm	SHA-256: 0f1f66fc42c7bb3b92c16aa637ff3357b20f681c41bc63f4271725efaeebc415
rhevm-setup-base-3.4.2-0.2.el6ev.noarch.rpm	SHA-256: 60b9e7c0754ff35f6577e7e15c1ac6ad3b71d9707d8611e1aac8f861e54d28df
rhevm-setup-plugin-allinone-3.4.2-0.2.el6ev.noarch.rpm	SHA-256: 477a7508b909a031b65f8657bc19c936a9105dc2965b8dfce33f4b119d0eedc2
rhevm-setup-plugin-ovirt-engine-3.4.2-0.2.el6ev.noarch.rpm	SHA-256: 68faf9d8cce5855c5f26de49688f90dd50df3fbc115c807749e924bc72b3d657
rhevm-setup-plugin-ovirt-engine-common-3.4.2-0.2.el6ev.noarch.rpm	SHA-256: c98af36c2e4f22912e5fa38ac933964be42d2dfd6aed9ccdcd8338aa683fabc4
rhevm-setup-plugin-websocket-proxy-3.4.2-0.2.el6ev.noarch.rpm	SHA-256: d436ecc6d627ec285f58bee472850d462564fcafb2cb81efca56a8ccef00e06c
rhevm-tools-3.4.2-0.2.el6ev.noarch.rpm	SHA-256: 7e63c6a0865a25d2b372b4c0edc6d64fd1401df253c399144f3dba30d18ee4c5
rhevm-userportal-3.4.2-0.2.el6ev.noarch.rpm	SHA-256: ac5349b809eec97bb644797efd05c498d3a395ed6c801a6586d59978fd18867d
rhevm-webadmin-portal-3.4.2-0.2.el6ev.noarch.rpm	SHA-256: 101a6aebd637194faccbba883683169173b08881470df5675da215e09152b160
rhevm-websocket-proxy-3.4.2-0.2.el6ev.noarch.rpm	SHA-256: fb116a57093c2519745301745267bbce1e7eeb1b3756bff2a1c9989229e68d1d