Synopsis

Important: Red Hat Virtualization security update

Type/Severity

Security Advisory: Important

Topic

An update for redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.

The following packages have been upgraded to a later upstream version: imgbased (1.1.9), ovirt-node-ng (4.3.5), redhat-release-virtualization-host (4.3.5), redhat-virtualization-host (4.3.5). (BZ#1669357, BZ#1669365, BZ#1684986, BZ#1711193, BZ#1717250, BZ#1726917)

Security Fix(es):

• python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc (CVE-2019-10160)
  
• rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is enabled (CVE-2018-16881)
  
• edk2: stack overflow in XHCI causing denial of service (CVE-2019-0161)
  
• openssl: 0-byte record padding oracle (CVE-2019-1559)
  
• cockpit-ovirt: admin and appliance passwords saved in plain text variable file during HE deployment (CVE-2019-10139)
  
• sssd: improper implementation of GPOs due to too restrictive permissions (CVE-2018-16838)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891

Affected Products

• Red Hat Virtualization 4 for RHEL 7 x86_64
• Red Hat Virtualization Host 4 for RHEL 7 x86_64

Fixes

• BZ - 1640820 - CVE-2018-16838 sssd: improper implementation of GPOs due to too restrictive permissions
• BZ - 1658366 - CVE-2018-16881 rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is enabled
• BZ - 1683804 - CVE-2019-1559 openssl: 0-byte record padding oracle
• BZ - 1687920 - RHVH fails to reinstall if required size is exceeding the available disk space due to anaconda bug
• BZ - 1694065 - CVE-2019-0161 edk2: stack overflow in XHCI causing denial of service
• BZ - 1702223 - Rebase RHV-H on RHEL 7.7
• BZ - 1709829 - CVE-2019-10139 cockpit-ovirt: admin and appliance passwords saved in plain text variable file during HE deployment
• BZ - 1718388 - CVE-2019-10160 python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
• BZ - 1720156 - RHVH 4.3.4 version info is incorrect in plymouth and "/etc/os-release"
• BZ - 1720160 - RHVH 4.3.4: Incorrect info in /etc/system-release-cpe
• BZ - 1720310 - RHV-H post-installation scripts failing, due to existing tags
• BZ - 1720434 - RHVH 7.7 brand is wrong in Anaconda GUI.
• BZ - 1720435 - Failed to install RHVH 7.7
• BZ - 1720436 - RHVH 7.7 should based on RHEL 7.7 server but not workstation.
• BZ - 1724044 - Failed dependencies occur during install systemtap package.
• BZ - 1726534 - dhclient fails to load libdns-export.so.1102 after upgrade if the user installed library is not persisted on the new layer
• BZ - 1727007 - Update RHVH 7.7 branding with new Red Hat logo
• BZ - 1727859 - Failed to boot after upgrading a host with a custom kernel
• BZ - 1728998 - "nodectl info" displays error after RHVH installation
• BZ - 1729023 - The error message is inappropriate when run `imgbase layout --init` on current layout

CVEs

• CVE-2018-16838
• CVE-2018-16881
• CVE-2019-0161
• CVE-2019-1559
• CVE-2019-10139
• CVE-2019-10160

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Virtualization 4 for RHEL 7

SRPM
imgbased-1.1.9-0.1.el7ev.src.rpm	SHA-256: 67ebfabe1e8cd4cff1163b04d2062b109ff5833403b77c69d02cacebfe16a17b
ovirt-node-ng-4.3.5-0.20190717.0.el7ev.src.rpm	SHA-256: 8426ea8063be7c13e4c492fe74b9334e052235bd4a92174f6d6e12fccb3cb9f8
redhat-release-virtualization-host-4.3.5-2.el7ev.src.rpm	SHA-256: 47787b636156d389e3fb07f97fc4da5344b5b2f2eef160ba67a47bfbf8377e8c
x86_64
imgbased-1.1.9-0.1.el7ev.noarch.rpm	SHA-256: 156b86560bcd756eaa408a1ccbea0c3353b26dc46f739695bc0fb67efb7440db
ovirt-node-ng-nodectl-4.3.5-0.20190717.0.el7ev.noarch.rpm	SHA-256: 815c4139b6dc949d3e9e6267ca7ace0e41e7d885d0184d82455011f8351233e8
python-imgbased-1.1.9-0.1.el7ev.noarch.rpm	SHA-256: b0404fc7ecb5560392781ee0fcf9cfea20c6f2ee55ecd59330ffdcd2a6015f7d
python2-ovirt-node-ng-nodectl-4.3.5-0.20190717.0.el7ev.noarch.rpm	SHA-256: 10d3a9190f64d5fedd11528634fdf5eff7a685662fc8af6976fc97a5f45b6215
redhat-release-virtualization-host-4.3.5-2.el7ev.x86_64.rpm	SHA-256: 82b753991bdc8c4d8b10610278bddd9ade386f58156b5fee3ebd38dcc2a315e2
redhat-virtualization-host-image-update-placeholder-4.3.5-2.el7ev.noarch.rpm	SHA-256: 08d47dbed230fb4d143a3aeea013589a973f5fa4fa48c99f4bcabc25290263b5

Red Hat Virtualization Host 4 for RHEL 7

SRPM
redhat-virtualization-host-4.3.5-20190722.0.el7_7.src.rpm	SHA-256: a4e21367a08e8a29d281da6ab81dbc9f9217983896710839c9ff7a292dc8ca3b
x86_64
redhat-virtualization-host-image-update-4.3.5-20190722.0.el7_7.noarch.rpm	SHA-256: 092a2492320665f756c35e8fda8da5df6514af4b60e7cbba2372a8aff30031ed