Synopsis

Moderate: Red Hat Virtualization Manager (RHV) bug fix 3.6.9

Type/Severity

Security Advisory: Moderate

Topic

An update for org.ovirt.engine-root is now available for RHEV Manager version 3.6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The Red Hat Virtualization Manager is a centralized management platform
that allows system administrators to view and manage virtual machines. The
Manager provides a comprehensive range of features including search
capabilities, resource management, live migrations, and virtual
infrastructure provisioning.

The Manager is a JBoss Application Server application that provides several
interfaces through which the virtual environment can be accessed and
interacted with, including an Administration Portal, a User Portal, and a
Representational State Transfer (REST) Application Programming Interface
(API).

Security Fix(es):

• A flaw was found in RHEV Manager, where it wrote sensitive data to the engine-setup log file. A local attacker could exploit this flaw to view sensitive information such as encryption keys and certificates (which could then be used to steal other sensitive information such as passwords). (CVE-2016-4443)
  

This issue was discovered by Simone Tiraboschi (Red Hat).

Bug Fix(es):

• With this update, users are now warned to set the system in global maintenance mode before running the engine-setup command. This is because data corruption may occur if the engine-setup command is run without setting the system into global maintenance mode. This update means that the user is warned and the setup will be aborted if the system is not in global maintenance mode and the engine is running in the hosted engine configuration. (BZ#1359844)
  
• Previously, the update of the compatibility version of a cluster with many running virtual machines that are installed with the guest-agent caused a deadlock that caused the update to fail. In some cases, these clusters could not be upgraded to a newer compatibility version. Now, the deadlock in the database has been prevented so that a cluster with many running virtual machines that are installed with the guest-agent can be upgraded to newer compatibility version. (BZ#1369415)
  
• Previously, a virtual machine with a null CPU profile id stored in the database caused a NPE when editing the virtual machine. Now, a virtual machine with a null CPU profile id stored in the database is correctly handled and the virtual machine can be edited. (BZ#1373090)
  
• Setting only one of the thresholds for power saving/evenly distributed memory based balancing (high or low) can lead to unexpected results. For example, when in power saving load balancing the threshold for memory over utilized hosts was set with a value, and the threshold for memory under utilized hosts was undefined thus getting a default value of 0. All hosts were considered as under utilized hosts and were chosen as sources for migration, but no host was chosen as a destination for migration.
  

This has now been changed so that when the threshold for memory under utilized host is undefined, it gets a default value of Long.MAX. Now, when the threshold for memory over utilized hosts is set with a value, and the threshold for memory under utilized host is undefined, only over utilized hosts will be selected as sources for migration, and destination hosts will be hosts that are not over utilized. (BZ#1359767)

• Previously, recently added logs that printed the amount of virtual machines running on a host were excessively written to the log file. Now, the frequency of these log have been reduced by printing them only upon a change in the number of virtual machines running on the host. (BZ#1367519)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Virtualization 3.6 x86_64
• Red Hat Virtualization for IBM Power LE 3.6 x86_64

Fixes

• BZ - 1335106 - CVE-2016-4443 org.ovirt.engine-root: engine-setup logs contained information for extracting admin password
• BZ - 1346754 - [z-stream clone - 3.6.8] Storage QoS is not applying on a Live VM/disk
• BZ - 1349345 - [downsream clone - 3.6.8] Incorrect behavior of power saving weight module
• BZ - 1352462 - [z-stream clone - 3.6.8] Hosted Engine's disk is in Unassigned Status in the RHEV UI
• BZ - 1356127 - Can't upgrade to new cluster version when HE VM is running in it
• BZ - 1356483 - HE can't get started if a new vNIC was added with an empty profile.
• BZ - 1358286 - [z-stream clone - 3.6.9] [AAA] Can't add IPA directory users to VM permissions
• BZ - 1359767 - [z-stream clone - 3.6.9] All hosts filtered out when memory underutilized parameter left out
• BZ - 1359844 - [downsream clone - 3.6.9] engine-setup should warn users running within hosted engine to set to maintenance
• BZ - 1360775 - [downstream clone - 3.6.9] Pass through host CPU is not enabled with manual migration
• BZ - 1361500 - [downstream clone] CPU Profile is not assigned when changing it on a running VM
• BZ - 1362001 - [z-stream clone - 3.6.9] RunVm endAction throws NPE when starting VM from Pool
• BZ - 1367519 - VmsStatisticsFetcher excessive logging in engine.log (clone of bug 1366138 for 3.6.9)
• BZ - 1369415 - [z-stream clone - 3.6.9] [InClusterUpgrade] Possible race condition with large amount of VMs in cluster
• BZ - 1369695 - [downstream clone - 3.6.9] password DWH_DB_PASSWORD not hidden
• BZ - 1372812 - [z-stream clone - 3.6.9] HA VMs are not restarted on different host if NonResponsive host is off and start action failed
• BZ - 1373090 - [downstream clone - 3.6.9] [Upgrade] Cluster compatibility upgrade 3.6-> 4.0 failed on a specific system

CVEs

• CVE-2016-4443

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat Virtualization 3.6

SRPM
rhevm-3.6.9.2-0.1.el6.src.rpm	SHA-256: 08f4b861b276f9527ab0d3d5d89d05e31e4c9f0d66e14c083a8b16ec1bc5fa88
x86_64
rhevm-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 48fc035bf57dbcc364186b4aa2f4a79b53f4474293211f28b6edd05c292bbb41
rhevm-backend-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: be1686a0bd13847d5b1f693b9297dacc00278cf5e761f006454c66f95baa7a32
rhevm-dbscripts-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 1eaa4793ebe4cb64d76103ffd694991fde89c149425083daf934e34c356d61a4
rhevm-extensions-api-impl-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: c1443606c4768a2e44df7b9335787528f82a145da3ff096170bb83148b72d200
rhevm-extensions-api-impl-javadoc-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: dd56e85d0d775cb6f5459894340881d453529d8f2f975cc15d70d1e7a6594a49
rhevm-lib-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: bb56cdde58806b8f07f48b180d4d66323a1c5161cd79cffb4d4cbecfcb518eae
rhevm-restapi-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 9b429eb8b15632183f2efda457e340291bbfbd95ad38b0c9a935fd5be90d5cc4
rhevm-setup-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: cf98461516e5e30c888ee8b30dff3ced20c7d5da4498ed79ac1a9d334d6d6c22
rhevm-setup-base-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 4266558f10cbacf576c182067043d56badd24d1261b27072b2e5e6231c52d9c1
rhevm-setup-plugin-ovirt-engine-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: c19f8cb295a22626e647cb339fce286728e790a8b75bcda0b2c1962a5b80d83f
rhevm-setup-plugin-ovirt-engine-common-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: d4fd349643b68e7f7de2dfca0483b13ac62acaec56c212b621a5f4ee29186683
rhevm-setup-plugin-vmconsole-proxy-helper-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: b42d9819e9b20587ee39d75af6a42b9fcc452e28f3821e4a60c30e39930d36aa
rhevm-setup-plugin-websocket-proxy-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 3bbfc50ec8f9c98826acaf69655c9186bcca32cbbfcf232030d2dad272a6cda3
rhevm-tools-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: d70bb87345de3e26f881b01f595de24fce9f8f0e170b536b6f5dae13459d43f0
rhevm-tools-backup-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 40efedfc3543b44974e93802b2c54f31626f38dcc4e9277d40d15994b0b20826
rhevm-userportal-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 612e056879ee7e14a045d96d8804f7e669025b837ccf1204d60b24edd2d84cf2
rhevm-userportal-debuginfo-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 0d649aa318404fa916bad0ace0e2daea14e1c0f95f4b061a607ca4befc103a95
rhevm-vmconsole-proxy-helper-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 0568e9cd044b063034a0be8d426cd1584b12134da38e04548eec3cd12b5400c8
rhevm-webadmin-portal-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 52d73ba597900f3d41ac433d4412b7d777122e6726fc0b355b548db9e30713d4
rhevm-webadmin-portal-debuginfo-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: d844c0be3e38a3766bc6d2d02d8eb1cff26b1eeba42d997850f2ed11b9668115
rhevm-websocket-proxy-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 4ca885c52254480f5cbd89eea87a6400030c34155976435d507ac3c8b24c6e00

Red Hat Virtualization for IBM Power LE 3.6

SRPM
rhevm-3.6.9.2-0.1.el6.src.rpm	SHA-256: 08f4b861b276f9527ab0d3d5d89d05e31e4c9f0d66e14c083a8b16ec1bc5fa88
x86_64
rhevm-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 48fc035bf57dbcc364186b4aa2f4a79b53f4474293211f28b6edd05c292bbb41
rhevm-backend-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: be1686a0bd13847d5b1f693b9297dacc00278cf5e761f006454c66f95baa7a32
rhevm-dbscripts-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 1eaa4793ebe4cb64d76103ffd694991fde89c149425083daf934e34c356d61a4
rhevm-extensions-api-impl-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: c1443606c4768a2e44df7b9335787528f82a145da3ff096170bb83148b72d200
rhevm-extensions-api-impl-javadoc-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: dd56e85d0d775cb6f5459894340881d453529d8f2f975cc15d70d1e7a6594a49
rhevm-lib-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: bb56cdde58806b8f07f48b180d4d66323a1c5161cd79cffb4d4cbecfcb518eae
rhevm-restapi-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 9b429eb8b15632183f2efda457e340291bbfbd95ad38b0c9a935fd5be90d5cc4
rhevm-setup-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: cf98461516e5e30c888ee8b30dff3ced20c7d5da4498ed79ac1a9d334d6d6c22
rhevm-setup-base-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 4266558f10cbacf576c182067043d56badd24d1261b27072b2e5e6231c52d9c1
rhevm-setup-plugin-ovirt-engine-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: c19f8cb295a22626e647cb339fce286728e790a8b75bcda0b2c1962a5b80d83f
rhevm-setup-plugin-ovirt-engine-common-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: d4fd349643b68e7f7de2dfca0483b13ac62acaec56c212b621a5f4ee29186683
rhevm-setup-plugin-vmconsole-proxy-helper-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: b42d9819e9b20587ee39d75af6a42b9fcc452e28f3821e4a60c30e39930d36aa
rhevm-setup-plugin-websocket-proxy-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 3bbfc50ec8f9c98826acaf69655c9186bcca32cbbfcf232030d2dad272a6cda3
rhevm-tools-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: d70bb87345de3e26f881b01f595de24fce9f8f0e170b536b6f5dae13459d43f0
rhevm-tools-backup-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 40efedfc3543b44974e93802b2c54f31626f38dcc4e9277d40d15994b0b20826
rhevm-userportal-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 612e056879ee7e14a045d96d8804f7e669025b837ccf1204d60b24edd2d84cf2
rhevm-userportal-debuginfo-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 0d649aa318404fa916bad0ace0e2daea14e1c0f95f4b061a607ca4befc103a95
rhevm-vmconsole-proxy-helper-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 0568e9cd044b063034a0be8d426cd1584b12134da38e04548eec3cd12b5400c8
rhevm-webadmin-portal-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 52d73ba597900f3d41ac433d4412b7d777122e6726fc0b355b548db9e30713d4
rhevm-webadmin-portal-debuginfo-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: d844c0be3e38a3766bc6d2d02d8eb1cff26b1eeba42d997850f2ed11b9668115
rhevm-websocket-proxy-3.6.9.2-0.1.el6.noarch.rpm	SHA-256: 4ca885c52254480f5cbd89eea87a6400030c34155976435d507ac3c8b24c6e00