Red Hat Security Advisory

RHSA-2018:1525

rhvm-appliance security and enhancement update

Released 2018-05-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Virtualization 4 Hypervisor for RHEL 7 rhvm-appliance-2:4.2-20180504.0.el7
Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhvm-appliance-2:4.2-20180504.0.el7

Fixes 6 records

TI-2018-01029 CVE-2018-1111 · GHSA-5jw9-5ff9-vr5p

Command injection in Red Hat dhcp

HIGH 77

DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client.

CVSS 3.0HIGH 7.5 Adjacent network No auth No interaction EPSS 0.97862 Published 2018-05-17 Fixed CWE-77

TI-2018-05593 CVE-2018-7750 · GHSA-232r-66cg-79px

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before…

MEDIUM 64

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly chec…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.27105 Published 2018-03-13 Partial fix · 2.0.8, 2.1.5 +5 CWE-287

TI-2018-05845 CVE-2018-8088 · GHSA-w77p-8cfg-2x43

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows…

MEDIUM 58

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.14703 Published 2018-03-20 Partial fix · 1.7.26, 1.8.0-beta4 CWE-284

TI-2018-04337 CVE-2018-5968 · GHSA-w3f4-3q6j-rh82

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated…

MEDIUM 53

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.07245 Published 2018-01-22 Partial fix · 2.8.11.1, 2.9.4 +1 CWE-184

TI-2017-08986 CVE-2017-12196 · GHSA-cp7v-vmv7-6x2q

Improper authentication in undertow

LOW 30

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP r…

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.02011 Published 2018-04-18 Partial fix · 2.0.2.FInal, 1.4.24.Final CWE-287

TI-2018-00993 CVE-2018-1073 · GHSA-9ghh-fm37-vrf7

Information disclosure through error messages in [UNKNOWN] ovirt-engine

LOW 28

The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01816 Published 2018-06-19 Fixed CWE-209