RHSA-2022:8502 - Security Advisory

Topic

Updated ovirt-engine packages that fix several bugs and add various enhancements are now available.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform that allows system administrators to view and manage virtual machines. The Manager provides a comprehensive range of features including search capabilities, resource management, live migrations, and virtual infrastructure provisioning.

Security Fix(es):

• follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor (CVE-2022-0155)
• ovirt-engine: RHVM admin password is logged unfiltered when using otopi-style (CVE-2022-2805)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Ghost OVFs are written when using floating SD to migrate VMs between 2 RHV environments. (BZ#1705338)
• RHV engine is reporting a delete disk with wipe as completing successfully when it actually fails from a timeout. (BZ#1836318)
• [DR] Failover / Failback HA VM Fails to be started due to 'VM XXX is being imported' (BZ#1968433)
• Virtual Machine with lease fails to run on DR failover (BZ#1974535)
• Disk is missing after importing VM from Storage Domain that was detached from another DC. (BZ#1983567)
• Unable to switch RHV host into maintenance mode as there are image transfer in progress (BZ#2123141)
• not able to import disk in 4.5.2 (BZ#2134549)

Enhancement(s):

• [RFE] Show last events for user VMs (BZ#1886211)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891

Affected Products

• Red Hat Virtualization Manager 4.4 x86_64

Fixes

• BZ - 1705338 - Ghost OVFs are written when using floating SD to migrate VMs between 2 RHV environments.
• BZ - 1836318 - RHV engine is reporting a delete disk with wipe as completing successfully when it actually fails from a timeout.
• BZ - 1886211 - [RFE] Show last events for user VMs
• BZ - 1968433 - [DR] Failover / Failback HA VM Fails to be started due to 'VM XXX is being imported'
• BZ - 1974535 - Virtual Machine with lease fails to run on DR failover
• BZ - 1983567 - Disk is missing after importing VM from Storage Domain that was detached from another DC.
• BZ - 2044556 - CVE-2022-0155 follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor
• BZ - 2079545 - CVE-2022-2805 ovirt-engine: RHVM admin password is logged unfiltered when using otopi-style
• BZ - 2118672 - Use rpm instead of auto in package_facts ansible module to prevent mistakes of determining the correct package manager inside package_facts module
• BZ - 2123141 - Unable to switch RHV host into maintenance mode as there are image transfer in progress
• BZ - 2127836 - Create template dialog is not closed when clicking in OK and the template is not created
• BZ - 2134549 - not able to import disk in 4.5.2
• BZ - 2137207 - The RemoveDisk job finishes before the disk was removed from the DB

CVEs

• CVE-2022-0155
• CVE-2022-2805

References

• https://access.redhat.com/security/updates/classification/#moderate