Red Hat Security Advisory

RHSA-2020:3807

Red Hat Virtualization security, bug fix, and enhancement update

Released 2020-09-23 · Red Hat rating Moderate · View on Red Hat →

Fixed in

RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-4.4.2.3-0.6.el8ev, ovirt-engine-backend-4.4.2.3-0.6.el8ev, ovirt-engine-dbscripts-4.4.2.3-0.6.el8ev +19

Fixes 4 records

TI-2020-08897 CVE-2020-11023 · GHSA-jpcq-cgw6-v4j6

Potential XSS vulnerability in jQuery

CRITICAL 88KEV

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.84887 Published 2020-04-29 Partial fix · 3.5.0, 4.4.0 CWE-79

TI-2020-08896 CVE-2020-11022 · GHSA-gxr4-xjj5-5px2

jQuery has a potential XSS vulnerability

HIGH 75

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.99215 Published 2020-04-29 Partial fix · 3.5.0, 4.4.0 +2 CWE-79

TI-2020-06621 CVE-2020-8203 · GHSA-p6mc-m468-83gw

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

MEDIUM 41

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.05213 Published 2020-07-15 Partial fix · 4.17.19, 4.17.20 CWE-770

TI-2020-11204 CVE-2020-14333 · GHSA-p9q6-rx74-627c

Cross-site scripting in ovirt-engine

LOW 29

A flaw was found in Ovirt Engine's web interface in ovirt 4.4 and earlier, where it did not filter user-controllable parameters completely, resulting in a reflected cross-site scripting attack.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.0079 Published 2020-08-18 Fixed CWE-79