Red Hat Security AdvisoryRHSA-2021:2239
Red Hat Virtualization Host security update [ovirt-4.4.6]
Released 2021-06-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.4.6-20210527.3.el8_4, redhat-virtualization-host-image-update-4.4.6-20210527.3.el8_4
Fixes 3 records
Priority MEDIUM 49
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.06799 · Published 2021-02-07 · Partial fix · 3.3.2 CWE-190
Priority MEDIUM 46
MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recurs…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04417 · Published 2020-11-06 · Partial fix CWE-674
Priority LOW 31
python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.02463 · Published 2021-01-11 · Partial fix · 3.2 CWE-385
