Red Hat Security AdvisoryRHSA-2016:2577
libvirt security, bug fix, and enhancement update
Released 2016-11-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) libvirt-2.0.0-10.el7, libvirt-client-2.0.0-10.el7, libvirt-daemon-2.0.0-10.el7 +11
- Red Hat Enterprise Linux Client Optional (v. 7) libvirt-daemon-lxc-2.0.0-10.el7, libvirt-devel-2.0.0-10.el7, libvirt-docs-2.0.0-10.el7 +3
- Red Hat Enterprise Linux ComputeNode (v. 7) libvirt-2.0.0-10.el7, libvirt-client-2.0.0-10.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libvirt-2.0.0-10.el7, libvirt-daemon-2.0.0-10.el7, libvirt-daemon-config-network-2.0.0-10.el7 +16
- Red Hat Enterprise Linux Server (v. 7) libvirt-2.0.0-10.el7, libvirt-client-2.0.0-10.el7, libvirt-client-2.0.0-10.el7.ppc +15
- Red Hat Enterprise Linux Server Optional (v. 7) libvirt-daemon-kvm-2.0.0-10.el7, libvirt-daemon-lxc-2.0.0-10.el7, libvirt-lock-sanlock-2.0.0-10.el7 +3
- Red Hat Enterprise Linux Workstation (v. 7) libvirt-2.0.0-10.el7, libvirt-client-2.0.0-10.el7, libvirt-daemon-2.0.0-10.el7 +13
- Red Hat Enterprise Linux Workstation Optional (v. 7) libvirt-daemon-lxc-2.0.0-10.el7, libvirt-lock-sanlock-2.0.0-10.el7, libvirt-login-shell-2.0.0-10.el7 +1
- Red Hat Gluster Storage Server 3.1 on RHEL-7 libvirt-daemon-lxc-2.0.0-10.el7, libvirt-lock-sanlock-2.0.0-10.el7, libvirt-login-shell-2.0.0-10.el7
- Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts libvirt-2.0.0-10.el7, libvirt-daemon-kvm-2.0.0-10.el7, libvirt-lock-sanlock-2.0.0-10.el7
Fixes 3 records
Priority MEDIUM 48
libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03653 · Published 2016-07-13 · Partial fix CWE-284
Priority LOW 25
libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.
CVSS 3.0MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00413 · Published 2018-08-20 · Partial fix CWE-200
Priority LOW 13
Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with stora…
CVSS 3.0LOW 2.5· Local · Low privileges · No interaction · EPSS 0.00455 · Published 2016-04-11 · Partial fix CWE-22
THREATIST.IORead the docs