—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat Virtualization security, bug fix, and enhancement update
Advisory ID: RHSA-2020:3807-01
Product: Red Hat Virtualization
Advisory URL: https://access.redhat.com/errata/RHSA-2020:3807
Issue date: 2020-09-23
CVE Names: CVE-2020-8203 CVE-2020-11022 CVE-2020-11023
CVE-2020-14333
=====================================================================
1. Summary:
An update is now available for Red Hat Virtualization Engine 4.4.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
RHEL-8-RHEV-S-4.4 – Red Hat Virtualization Engine 4.4 – noarch
3. Description:
The org.ovirt.engine-root is a core component of oVirt.
The following packages have been upgraded to a later upstream version:
ansible-runner-service (1.0.5), org.ovirt.engine-root (4.4.2.3),
ovirt-engine-dwh (4.4.2.1), ovirt-engine-extension-aaa-ldap (1.4.1),
ovirt-engine-ui-extensions (1.2.3), ovirt-log-collector (4.4.3),
ovirt-web-ui (1.6.4), rhvm-branding-rhv (4.4.5), rhvm-dependencies (4.4.1),
vdsm-jsonrpc-java (1.5.5). (BZ#1674420, BZ#1866734)
A list of bugs fixed in this update is available in the Technical Notes
book:
https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/ht
ml-single/technical_notes
Security Fix(es):
* nodejs-lodash: prototype pollution in zipObjectDeep function
(CVE-2020-8203)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter
method (CVE-2020-11022)
* jQuery: passing HTML containing <option> elements to manipulation methods
could result in untrusted code execution (CVE-2020-11023)
* ovirt-engine: Reflected cross site scripting vulnerability
(CVE-2020-14333)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Bug Fix(es):
* Cannot assign direct LUN from FC storage – grayed out (BZ#1625499)
* VM portal always asks how to open console.vv even it has been set to
default application. (BZ#1638217)
* RESTAPI Not able to remove the QoS from a disk profile (BZ#1643520)
* On OVA import, qemu-img fails to write to NFS storage domain (BZ#1748879)
* Possible missing block path for a SCSI host device needs to be handled in
the UI (BZ#1801206)
* Scheduling Memory calculation disregards huge-pages (BZ#1804037)
* Engine does not reduce scheduling memory when a VM with dynamic hugepages
runs. (BZ#1804046)
* In Admin Portal, “Huge Pages (size: amount)” needs to be clarified
(BZ#1806339)
* Refresh LUN is using host from different Data Center to scan the LUN
(BZ#1838051)
* Unable to create Windows VM’s with Mozilla Firefox version 74.0.1 and
greater for RHV-M GUI/Webadmin portal (BZ#1843234)
* [RHV-CNV] – NPE when creating new VM in cnv cluster (BZ#1854488)
* [CNV&RHV] Add-Disk operation failed to complete. (BZ#1855377)
* Cannot create KubeVirt VM as a normal user (BZ#1859460)
* Welcome page – remove Metrics Store links and update “Insights Guide”
link (BZ#1866466)
* [RHV 4.4] Change in CPU model name after RHVH upgrade (BZ#1869209)
* VM vm-name is down with error. Exit message: unsupported configuration:
Can’t add USB input device. USB bus is disabled. (BZ#1871235)
* spec_ctrl host feature not detected (BZ#1875609)
Enhancement(s):
* [RFE] API for changed blocks/sectors for a disk for incremental backup
usage (BZ#1139877)
* [RFE] Improve workflow for storage migration of VMs with multiple disks
(BZ#1749803)
* [RFE] Move the Remove VM button to the drop down menu when viewing
details such as snapshots (BZ#1763812)
* [RFE] enhance search filter for Storage Domains with free argument
(BZ#1819260)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/2974891
5. Bugs fixed (https://bugzilla.redhat.com/):
1625499 – Cannot assign direct LUN from FC storage – grayed out
1638217 – VM portal always asks how to open console.vv even it has been set to default application.
1643520 – RESTAPI Not able to remove the QoS from a disk profile
1674420 – [RFE] – add support for Cascadelake-Server CPUs (and IvyBridge)
1748879 – On OVA import, qemu-img fails to write to NFS storage domain
1749803 – [RFE] Improve workflow for storage migration of VMs with multiple disks
1758024 – Long running Ansible tasks timeout and abort for RHV-H hosts with STIG/Security Profiles applied
1763812 – [RFE] Move the Remove VM button to the drop down menu when viewing details such as snapshots
1778471 – Using more than one asterisk in LDAP search string is not working when searching for AD users.
1787854 – RHV: Updating/reinstall a host which is part of affinity labels is removed from the affinity label.
1801206 – Possible missing block path for a SCSI host device needs to be handled in the UI
1803856 – [Scale] ovirt-vmconsole takes too long or times out in a 500+ VM environment.
1804037 – Scheduling Memory calculation disregards huge-pages
1804046 – Engine does not reduce scheduling memory when a VM with dynamic hugepages runs.
1806339 – In Admin Portal, “Huge Pages (size: amount)” needs to be clarified
1816951 – [CNV&RHV] CNV VM migration failure is not handled correctly by the engine
1819260 – [RFE] enhance search filter for Storage Domains with free argument
1826255 – [CNV&RHV]Change name of type of provider – CNV -> OpenShift Virtualization
1828406 – CVE-2020-11022 jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
1831949 – RESTAPI javadoc contains missing information about assigning IP address to NIC
1831952 – RESTAPI contains malformed link around JSON representation fo the cluster
1831954 – RESTAPI javadoc contains malformed link around oVirt guest agent
1831956 – RESTAPI javadoc contains malformed link around time zone representation
1838051 – Refresh LUN is using host from different Data Center to scan the LUN
1841112 – not able to upload vm from OVA when there are 2 OVA from the same vm in same directory
1843234 – Unable to create Windows VM’s with Mozilla Firefox version 74.0.1 and greater for RHV-M GUI/Webadmin portal
1850004 – CVE-2020-11023 jQuery: passing HTML containing <option> elements to manipulation methods could result in untrusted code execution
1854488 – [RHV-CNV] – NPE when creating new VM in cnv cluster
1855377 – [CNV&RHV] Add-Disk operation failed to complete.
1857412 – CVE-2020-8203 nodejs-lodash: prototype pollution in zipObjectDeep function
1858184 – CVE-2020-14333 ovirt-engine: Reflected cross site scripting vulnerability
1859460 – Cannot create KubeVirt VM as a normal user
1860907 – Upgrade bundled GWT to 2.9.0
1866466 – Welcome page – remove Metrics Store links and update “Insights Guide” link
1866734 – [DWH] Rebase bug – for the 4.4.2 release
1869209 – [RHV 4.4] Change in CPU model name after RHVH upgrade
1869302 – ansible 2.9.12 – host deploy fixes
1871235 – VM vm-name is down with error. Exit message: unsupported configuration: Can’t add USB input device. USB bus is disabled.
1875609 – spec_ctrl host feature not detected
1875851 – Web Admin interface broken on Firefox ESR 68.11
6. Package List:
RHEL-8-RHEV-S-4.4 – Red Hat Virtualization Engine 4.4:
Source:
ansible-runner-service-1.0.5-1.el8ev.src.rpm
ovirt-engine-4.4.2.3-0.6.el8ev.src.rpm
ovirt-engine-dwh-4.4.2.1-1.el8ev.src.rpm
ovirt-engine-extension-aaa-ldap-1.4.1-1.el8ev.src.rpm
ovirt-engine-ui-extensions-1.2.3-1.el8ev.src.rpm
ovirt-log-collector-4.4.3-1.el8ev.src.rpm
ovirt-web-ui-1.6.4-1.el8ev.src.rpm
rhvm-branding-rhv-4.4.5-1.el8ev.src.rpm
rhvm-dependencies-4.4.1-1.el8ev.src.rpm
vdsm-jsonrpc-java-1.5.5-1.el8ev.src.rpm
noarch:
ansible-runner-service-1.0.5-1.el8ev.noarch.rpm
ovirt-engine-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-backend-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-dbscripts-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-dwh-4.4.2.1-1.el8ev.noarch.rpm
ovirt-engine-dwh-grafana-integration-setup-4.4.2.1-1.el8ev.noarch.rpm
ovirt-engine-dwh-setup-4.4.2.1-1.el8ev.noarch.rpm
ovirt-engine-extension-aaa-ldap-1.4.1-1.el8ev.noarch.rpm
ovirt-engine-extension-aaa-ldap-setup-1.4.1-1.el8ev.noarch.rpm
ovirt-engine-health-check-bundler-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-restapi-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-setup-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-setup-base-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-setup-plugin-cinderlib-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-setup-plugin-imageio-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-setup-plugin-ovirt-engine-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-setup-plugin-ovirt-engine-common-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-setup-plugin-vmconsole-proxy-helper-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-setup-plugin-websocket-proxy-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-tools-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-tools-backup-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-ui-extensions-1.2.3-1.el8ev.noarch.rpm
ovirt-engine-vmconsole-proxy-helper-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-webadmin-portal-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-websocket-proxy-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-log-collector-4.4.3-1.el8ev.noarch.rpm
ovirt-web-ui-1.6.4-1.el8ev.noarch.rpm
python3-ovirt-engine-lib-4.4.2.3-0.6.el8ev.noarch.rpm
rhvm-4.4.2.3-0.6.el8ev.noarch.rpm
rhvm-branding-rhv-4.4.5-1.el8ev.noarch.rpm
rhvm-dependencies-4.4.1-1.el8ev.noarch.rpm
vdsm-jsonrpc-java-1.5.5-1.el8ev.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2020-8203
https://access.redhat.com/security/cve/CVE-2020-11022
https://access.redhat.com/security/cve/CVE-2020-11023
https://access.redhat.com/security/cve/CVE-2020-14333
https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBX2t0HtzjgjWX9erEAQhpWg/+KolNmhmQCrst8TmYsC2IgSdHP+q0LKLj
gdPZYu0ixOpwLLiAhrsoDXqL3H3w7UDSKkSISgPMEqEde4Vp+zI37O1q3E/P7CAj
rfLGuL1UDEiy0q0g1BP13GrPlg6K4fR5wQAnTB6vD/ZY+wd50Z0T+NGAxd2w68bM
R5q1kSOUPc4AZt25FORU2cmp775Y7DWazMWHC77uiJHgyCwVqLtdO09iEnglZDKJ
BynwyT8exZKXxmmpE4QZ4X7wNo3Y0mTiRZo5eyxxQpwj9X+qw1V+pBdtMH/C1yhk
J+X1f+wDoe2jCx2bqPXqp6EgFSHnJNt96jV0oTdD0f8rMgWcBDStNXdagPBmBCBp
t+Kq3BZx0Oqkig4f+DCEmoS0V0fB9UQLg0Q/M9p1bTfYQkbn+BMHL7CAp8UyAzPH
A1HlnP7TtQgplFvoap82xt2pXh97VvI6x3sBGHyW4Fz0SykhRYx3dAgmqy5nEssl
5ApWZ87M3l+2tUh4ZOJAtzRDt9sL5KQsXjp1jZaK/gWBsL4Suzr9AIrs4NmRmXnY
TzxdXgIY6C+dWmB4TPhcJE5etcvtorqvs93d47yBdpRyO/IlbEw0vLUBdVZZuj9N
mqp6RcHqDKm6Yv4B73Ud5my44wSRWVWtBxO6fivQOQG7iqCyIlA3M3LUMkVy+fxc
bvmOI0eIsZw=
=Jhpi
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
