RedHat: RHSA-2020-3807:01 Moderate: Red Hat Virtualization security, bug fix,
Summary
The org.ovirt.engine-root is a core component of oVirt.
The following packages have been upgraded to a later upstream version:
ansible-runner-service (1.0.5), org.ovirt.engine-root (4.4.2.3),
ovirt-engine-dwh (4.4.2.1), ovirt-engine-extension-aaa-ldap (1.4.1),
ovirt-engine-ui-extensions (1.2.3), ovirt-log-collector (4.4.3),
ovirt-web-ui (1.6.4), rhvm-branding-rhv (4.4.5), rhvm-dependencies (4.4.1),
vdsm-jsonrpc-java (1.5.5). (BZ#1674420, BZ#1866734)
A list of bugs fixed in this update is available in the Technical Notes
book:
ml-single/technical_notes
Security Fix(es):
* nodejs-lodash: prototype pollution in zipObjectDeep function
(CVE-2020-8203)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter
method (CVE-2020-11022)
* jQuery: passing HTML containing
Summary
Solution
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/2974891
References
https://access.redhat.com/security/cve/CVE-2020-8203 https://access.redhat.com/security/cve/CVE-2020-11022 https://access.redhat.com/security/cve/CVE-2020-11023 https://access.redhat.com/security/cve/CVE-2020-14333 https://access.redhat.com/security/updates/classification/#moderate
Package List
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4:
Source:
ansible-runner-service-1.0.5-1.el8ev.src.rpm
ovirt-engine-4.4.2.3-0.6.el8ev.src.rpm
ovirt-engine-dwh-4.4.2.1-1.el8ev.src.rpm
ovirt-engine-extension-aaa-ldap-1.4.1-1.el8ev.src.rpm
ovirt-engine-ui-extensions-1.2.3-1.el8ev.src.rpm
ovirt-log-collector-4.4.3-1.el8ev.src.rpm
ovirt-web-ui-1.6.4-1.el8ev.src.rpm
rhvm-branding-rhv-4.4.5-1.el8ev.src.rpm
rhvm-dependencies-4.4.1-1.el8ev.src.rpm
vdsm-jsonrpc-java-1.5.5-1.el8ev.src.rpm
noarch:
ansible-runner-service-1.0.5-1.el8ev.noarch.rpm
ovirt-engine-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-backend-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-dbscripts-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-dwh-4.4.2.1-1.el8ev.noarch.rpm
ovirt-engine-dwh-grafana-integration-setup-4.4.2.1-1.el8ev.noarch.rpm
ovirt-engine-dwh-setup-4.4.2.1-1.el8ev.noarch.rpm
ovirt-engine-extension-aaa-ldap-1.4.1-1.el8ev.noarch.rpm
ovirt-engine-extension-aaa-ldap-setup-1.4.1-1.el8ev.noarch.rpm
ovirt-engine-health-check-bundler-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-restapi-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-setup-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-setup-base-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-setup-plugin-cinderlib-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-setup-plugin-imageio-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-setup-plugin-ovirt-engine-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-setup-plugin-ovirt-engine-common-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-setup-plugin-vmconsole-proxy-helper-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-setup-plugin-websocket-proxy-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-tools-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-tools-backup-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-ui-extensions-1.2.3-1.el8ev.noarch.rpm
ovirt-engine-vmconsole-proxy-helper-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-webadmin-portal-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-engine-websocket-proxy-4.4.2.3-0.6.el8ev.noarch.rpm
ovirt-log-collector-4.4.3-1.el8ev.noarch.rpm
ovirt-web-ui-1.6.4-1.el8ev.noarch.rpm
python3-ovirt-engine-lib-4.4.2.3-0.6.el8ev.noarch.rpm
rhvm-4.4.2.3-0.6.el8ev.noarch.rpm
rhvm-branding-rhv-4.4.5-1.el8ev.noarch.rpm
rhvm-dependencies-4.4.1-1.el8ev.noarch.rpm
vdsm-jsonrpc-java-1.5.5-1.el8ev.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
Topic
An update is now available for Red Hat Virtualization Engine 4.4.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.
Topic
Relevant Releases Architectures
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 - noarch
Bugs Fixed
1625499 - Cannot assign direct LUN from FC storage - grayed out
1638217 - VM portal always asks how to open console.vv even it has been set to default application.
1643520 - RESTAPI Not able to remove the QoS from a disk profile
1674420 - [RFE] - add support for Cascadelake-Server CPUs (and IvyBridge)
1748879 - On OVA import, qemu-img fails to write to NFS storage domain
1749803 - [RFE] Improve workflow for storage migration of VMs with multiple disks
1758024 - Long running Ansible tasks timeout and abort for RHV-H hosts with STIG/Security Profiles applied
1763812 - [RFE] Move the Remove VM button to the drop down menu when viewing details such as snapshots
1778471 - Using more than one asterisk in LDAP search string is not working when searching for AD users.
1787854 - RHV: Updating/reinstall a host which is part of affinity labels is removed from the affinity label.
1801206 - Possible missing block path for a SCSI host device needs to be handled in the UI
1803856 - [Scale] ovirt-vmconsole takes too long or times out in a 500+ VM environment.
1804037 - Scheduling Memory calculation disregards huge-pages
1804046 - Engine does not reduce scheduling memory when a VM with dynamic hugepages runs.
1806339 - In Admin Portal, "Huge Pages (size: amount)" needs to be clarified
1816951 - [CNV&RHV] CNV VM migration failure is not handled correctly by the engine
1819260 - [RFE] enhance search filter for Storage Domains with free argument
1826255 - [CNV&RHV]Change name of type of provider - CNV -> OpenShift Virtualization
1828406 - CVE-2020-11022 jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
1831949 - RESTAPI javadoc contains missing information about assigning IP address to NIC
1831952 - RESTAPI contains malformed link around JSON representation fo the cluster
1831954 - RESTAPI javadoc contains malformed link around oVirt guest agent
1831956 - RESTAPI javadoc contains malformed link around time zone representation
1838051 - Refresh LUN is using host from different Data Center to scan the LUN
1841112 - not able to upload vm from OVA when there are 2 OVA from the same vm in same directory
1843234 - Unable to create Windows VM's with Mozilla Firefox version 74.0.1 and greater for RHV-M GUI/Webadmin portal
1850004 - CVE-2020-11023 jQuery: passing HTML containing
1854488 - [RHV-CNV] - NPE when creating new VM in cnv cluster
1855377 - [CNV&RHV] Add-Disk operation failed to complete.
1857412 - CVE-2020-8203 nodejs-lodash: prototype pollution in zipObjectDeep function
1858184 - CVE-2020-14333 ovirt-engine: Reflected cross site scripting vulnerability
1859460 - Cannot create KubeVirt VM as a normal user
1860907 - Upgrade bundled GWT to 2.9.0
1866466 - Welcome page - remove Metrics Store links and update "Insights Guide" link
1866734 - [DWH] Rebase bug - for the 4.4.2 release
1869209 - [RHV 4.4] Change in CPU model name after RHVH upgrade
1869302 - ansible 2.9.12 - host deploy fixes
1871235 - VM vm-name is down with error. Exit message: unsupported configuration: Can't add USB input device. USB bus is disabled.
1875609 - spec_ctrl host feature not detected
1875851 - Web Admin interface broken on Firefox ESR 68.11
