RHSA-2021:1169 - Security Advisory

Topic

An update is now available for Red Hat Virtualization Engine 4.4.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The ovirt-engine package provides the manager for virtualization environments.
This manager enables admins to define hosts and networks, as well as to add
storage, create VMs and manage user permissions.

A list of bugs fixed in this update is available in the Technical Notes
book:

https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes

Security Fix(es):

• nodejs-bootstrap-select: not escaping title values on <option> may lead to XSS (CVE-2019-20921)
• m2crypto: bleichenbacher timing attacks in the RSA decryption API (CVE-2020-25657)
• datatables.net: prototype pollution if 'constructor' were used in a data property name (CVE-2020-28458)
• nodejs-immer: prototype pollution may lead to DoS or remote code execution (CVE-2020-28477)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891

Affected Products

• Red Hat Virtualization Manager 4.4 x86_64

Fixes

• BZ - 1145658 - Storage domain removal does not check if the storage domain contains any memory dumps.
• BZ - 1155275 - [RFE] - Online update LUN size to the Guest after LUN resize
• BZ - 1649479 - [RFE] OVF_STORE last update not exposed in the UI
• BZ - 1666786 - RHV-M reports "Balancing VM ${VM}" for ever as successful in the tasks list
• BZ - 1688186 - [RFE] CPU and NUMA Pinning shall be handled automatically
• BZ - 1729359 - Failed image upload leaves disk in locked state, requiring manual intervention to cleanup.
• BZ - 1787235 - [RFE] Offline disk move should log which host the data is being copied on in the audit log
• BZ - 1802844 - rest api setupnetworks: assignment_method should be inside ip_address_assignment
• BZ - 1837221 - [RFE] Allow using other than RSA SHA-1/SHA-2 public keys for SSH connections between RHVM and hypervisors
• BZ - 1843882 - network interface not added to public firewalld zone until host reboot
• BZ - 1858420 - Snapshot creation on host that engine then loses connection to results in missing snapshots table entry
• BZ - 1882273 - CVE-2019-20921 nodejs-bootstrap-select: not escaping title values on <option> may lead to XSS
• BZ - 1884233 - oVirt-engine reports misleading login-domain for external RH-SSO accounts
• BZ - 1889823 - CVE-2020-25657 m2crypto: bleichenbacher timing attacks in the RSA decryption API
• BZ - 1895217 - Hosted-Engine --restore-from-file fails if backup has VM pinned to restore host and has no Icon set.
• BZ - 1901503 - Misleading error message, displaying Data Center Storage Type instead of its name
• BZ - 1901752 - AddVds fails as FIPS host rejects SSH with ssh-rsa, failing HostedEngine deployment
• BZ - 1905108 - Cannot hotplug disk reports libvirtError: Requested operation is not valid: Domain already contains a disk with that address
• BZ - 1905158 - After upgrading RHVH 4.4.2 to 4.4.3 moves to non-operational due to missing CPU features : model_Cascadelake-Server
• BZ - 1908441 - CVE-2020-28458 datatables.net: prototype pollution if 'constructor' were used in a data property name
• BZ - 1910302 - [RFE] Allow SPM switching if all tasks have finished via UI
• BZ - 1913198 - Host deploy fails if 6+ hosts are deployed at the same time.
• BZ - 1914602 - [RHV 4.4] /var/lib/ovirt-engine/external_truststore (Permission denied)
• BZ - 1918162 - CVE-2020-28477 nodejs-immer: prototype pollution may lead to DoS or remote code execution
• BZ - 1919555 - Rebase apache-sshd to version 2.6.0 for RHV 4.4.5
• BZ - 1921104 - Bump required ansible version in RHV Manager 4.4.5
• BZ - 1921119 - RHV reports unsynced cluster when host QoS is in use.
• BZ - 1922200 - Checking the Engine database consistency takes too long to complete
• BZ - 1924012 - Rebase ansible-runner to 1.4.6
• BZ - 1926854 - [RFE] Requesting an audit log entry be added in LSM flow to display the host on which the internal volumes are copied
• BZ - 1927851 - [RFE] Add timezone AUS Eastern Standard Time
• BZ - 1931514 - [downstream] Cluster upgrade fails when using Intel Skylake Client/Server IBRS SSBD MDS Family
• BZ - 1931786 - Windows driver update does not work on cluster level 4.5

CVEs

• CVE-2019-20921
• CVE-2020-25657
• CVE-2020-28458
• CVE-2020-28477

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes