Red Hat Security AdvisoryRHSA-2015:0008
libvirt security and bug fix update
Released 2015-01-05 · Red Hat rating Low · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) libvirt-1.1.1-29.el7_0.4, libvirt-client-1.1.1-29.el7_0.4, libvirt-daemon-1.1.1-29.el7_0.4 +12
- Red Hat Enterprise Linux Client Optional (v. 7) libvirt-daemon-lxc-1.1.1-29.el7_0.4, libvirt-devel-1.1.1-29.el7_0.4, libvirt-docs-1.1.1-29.el7_0.4 +2
- Red Hat Enterprise Linux ComputeNode (v. 7) libvirt-1.1.1-29.el7_0.4, libvirt-client-1.1.1-29.el7_0.4
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libvirt-1.1.1-29.el7_0.4, libvirt-daemon-1.1.1-29.el7_0.4, libvirt-daemon-config-network-1.1.1-29.el7_0.4 +16
- Red Hat Enterprise Linux Server (v. 7) libvirt-1.1.1-29.el7_0.4, libvirt-client-1.1.1-29.el7_0.4, libvirt-client-1.1.1-29.el7_0.4.ppc +16
- Red Hat Enterprise Linux Server Optional (v. 7) libvirt-daemon-lxc-1.1.1-29.el7_0.4, libvirt-lock-sanlock-1.1.1-29.el7_0.4, libvirt-login-shell-1.1.1-29.el7_0.4
- Red Hat Enterprise Linux Workstation (v. 7) libvirt-1.1.1-29.el7_0.4, libvirt-client-1.1.1-29.el7_0.4, libvirt-daemon-1.1.1-29.el7_0.4 +14
- Red Hat Enterprise Linux Workstation Optional (v. 7) libvirt-daemon-lxc-1.1.1-29.el7_0.4, libvirt-lock-sanlock-1.1.1-29.el7_0.4, libvirt-login-shell-1.1.1-29.el7_0.4
Fixes 1 record
Priority LOW 27
The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.01905 · Published 2014-11-13 · Partial fix CWE-255
