Read the docs
Red Hat Security Advisory

RHSA-2022:6393

RHV Manager (ovirt-engine) [ovirt-4.5.2] bug fix and security update

Released 2022-09-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 6 records

TI-2020-08897 CVE-2020-11023 · GHSA-jpcq-cgw6-v4j6

Potential XSS vulnerability in jQuery

Priority CRITICAL 88KEV

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.84887 Published 2020-04-29 Partial fix · 3.5.0, 4.4.0 CWE-79
TI-2020-08896 CVE-2020-11022 · GHSA-gxr4-xjj5-5px2

jQuery has a potential XSS vulnerability

Priority HIGH 75

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.99215 Published 2020-04-29 Partial fix · 3.5.0, 4.4.0 +2 CWE-79
TI-2022-13173 CVE-2022-31129 · GHSA-wc69-rhjr-hc9g

Inefficient Regular Expression Complexity in moment

Priority HIGH 72

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05551 Published 2022-07-06 Partial fix · 2.29.4 CWE-400
TI-2021-06054 CVE-2021-23358 · GHSA-cf4h-3jhx-xvhq

Arbitrary code injection in underscore

Priority HIGH 67

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.042 Published 2021-03-29 Partial fix · 1.13.0-2, 1.12.1 CWE-94
TI-2022-02601 CVE-2022-2806 · GHSA-7pf9-7cff-f854

Information disclosure in ovirt-log-collector

Priority LOW 24

It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00251 Published 2022-09-01 Fixed in 4.4 CWE-200
TI-2021-05099 CVE-2021-22096 · GHSA-rfmp-97jj-h8m6

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported…

Priority LOW 23

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01352 Published 2021-10-28 Partial fix · 5.3.11, 5.2.18 CWE-117