Red Hat Security Advisory

RHSA-2019:2437

Red Hat Virtualization security update

Released 2019-08-12 · Red Hat rating Important · View on Red Hat →

Fixed in

RHEL 7-based RHEV-H for RHEV 4 (build requirements) imgbased-1.1.9-0.1.el7ev, ovirt-node-ng-4.3.5-0.20190717.0.el7ev, ovirt-node-ng-nodectl-4.3.5-0.20190717.0.el7ev +4
Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host-4.3.5-20190722.0.el7_7, redhat-virtualization-host-image-update-4.3.5-20190722.0.el7_7

Fixes 6 records

TI-2019-07481 CVE-2019-10160 · GHSA-379v-rm3f-c48g

Insufficiently protected credentials in python-pillow python

MEDIUM 50

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attack…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05227 Published 2019-06-07 Partial fix CWE-172

TI-2019-01190 CVE-2019-1559 · GHSA-9ccq-7hvh-cv7p

0-byte record padding oracle

MEDIUM 43

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte r…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.17139 Published 2019-02-27 Partial fix CWE-203

TI-2018-12091 CVE-2018-16881 · GHSA-hg54-w573-5vvv

Integer overflow in rsyslog:

LOW 37

A denial of service vulnerability was found in rsyslog in the imptcp module.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02238 Published 2019-01-25 Fixed CWE-190

TI-2019-07462 CVE-2019-10139 · GHSA-35c5-8h9g-6345

Insufficiently protected credentials in oVirt cockpit-ovirt

LOW 34

During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00245 Published 2019-05-17 Fixed CWE-522

TI-2018-12048 CVE-2018-16838 · GHSA-h2vj-4wwx-54q4

Improper access control in [UNKNOWN] sssd

LOW 27

A flaw was found in sssd Group Policy Objects implementation.

CVSS 3.0MEDIUM 5.4 Network Low privileges No interaction EPSS 0.01157 Published 2019-03-25 Fixed CWE-284

TI-2019-00140 CVE-2019-0161 · GHSA-jf2h-frpc-5873

Out-of-bounds write in TianoCore Extensible Firmware Interface Development Kit

LOW 25

Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.

CVSS 3.0MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00395 Published 2019-03-27 Fixed CWE-787