Red Hat Security AdvisoryRHSA-2020:4000
libvirt security and bug fix update
Released 2020-09-29 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) libvirt-4.5.0-36.el7, libvirt-bash-completion-4.5.0-36.el7, libvirt-client-4.5.0-36.el7 +21
- Red Hat Enterprise Linux Client Optional (v. 7) libvirt-admin-4.5.0-36.el7, libvirt-daemon-lxc-4.5.0-36.el7, libvirt-devel-4.5.0-36.el7 +4
- Red Hat Enterprise Linux ComputeNode (v. 7) libvirt-4.5.0-36.el7, libvirt-bash-completion-4.5.0-36.el7, libvirt-client-4.5.0-36.el7 +1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libvirt-4.5.0-36.el7, libvirt-admin-4.5.0-36.el7, libvirt-daemon-4.5.0-36.el7 +25
- Red Hat Enterprise Linux Server (v. 7) libvirt-4.5.0-36.el7, libvirt-bash-completion-4.5.0-36.el7, libvirt-client-4.5.0-36.el7 +26
- Red Hat Enterprise Linux Server Optional (v. 7) libvirt-admin-4.5.0-36.el7, libvirt-daemon-lxc-4.5.0-36.el7, libvirt-lock-sanlock-4.5.0-36.el7 +3
- Red Hat Enterprise Linux Workstation (v. 7) libvirt-4.5.0-36.el7, libvirt-bash-completion-4.5.0-36.el7, libvirt-client-4.5.0-36.el7 +22
- Red Hat Enterprise Linux Workstation Optional (v. 7) libvirt-admin-4.5.0-36.el7, libvirt-daemon-lxc-4.5.0-36.el7, libvirt-docs-4.5.0-36.el7 +3
Fixes 2 records
Priority LOW 33
A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.02383 · Published 2020-06-02 · Partial fix · 6.0.0 CWE-476
Priority LOW 27
qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage).
CVSS 3.1MEDIUM 5.7· Adjacent network · Low privileges · No interaction · EPSS 0.00813 · Published 2020-03-19 · Partial fix CWE-20
